nested iframes using iframe.contentDocument.createElement

[abrahamjuliot]

No description provided.

[abrahamjuliot]

Not sure nesting has an advantage if scripts are set to inject all frames

[abrahamjuliot]

Concept

const thisSiteCantBeReached = 'about:galvx7fxzm9rnburjkx'
const createIframe = (doc, id, contentWindow = false) => {
    const iframe = doc.createElement('iframe')
    iframe.setAttribute('id', id)
    iframe.setAttribute('style', 'visibility: hidden; height: 0')
    iframe.setAttribute('sandbox', 'allow-same-origin')
    if (window.chrome) {
        iframe.src = thisSiteCantBeReached 
    }
    doc.body.appendChild(iframe)
    const rendered = doc.getElementById(id)
    return {
        el: rendered,
        context: rendered[contentWindow ? 'contentWindow' : 'contentDocument'],
        remove: () => rendered.parentNode.removeChild(rendered)
    }
}

const parentIframe = createIframe(document, 'iframe-1')
const {
    context: win
} = createIframe(parentIframe.context, 'iframe-2', true)

// Needed for some Chrome Extensions
if (window.chrome) { win.location = thisSiteCantBeReached  }
setTimeout(() => { console.log(win.navigator.userAgent); parentIframe.remove() }, 100)  // try catch this

[abrahamjuliot]

improve test

inspired by https://canvasblocker.kkapsner.de/test/test.js

const len = window.length;
const div = document.createElement('div')
document.body.appendChild(div)
div.innerHTML = '<iframe></iframe>'
const iframeWindow = window[len]

function getDynamicIframeWindow({ context, nestIframeInContainerDiv = false }) {
    const elementName = nestIframeInContainerDiv ? 'div' : 'iframe'
    const length = context.length
    const element = document.createElement(elementName)
    document.body.appendChild(element)
    if (nestIframeInContainerDiv) {
        element.innerHTML = '<iframe></iframe>'
    }
    const iframeWindow = context[length]
    document.body.removeChild(element)
    return iframeWindow
}

getDynamicIframeWindow({ context: frames })
getDynamicIframeWindow({ context: window })
getDynamicIframeWindow({ context: window, nestIframeInContainerDiv: true })

[abrahamjuliot]

x number of nested iframes concept

(function() {
    'use strict';
    const getNestedIframes = (n, context = window) => {
        n = +n
        let parent, total = n
        return (function getIframeWindow(win, {
            previous = context
        } = {}) {
            if (!win) {
                console.log('stopped at ', total - n)
                return previous
            }
            const numberIframes = win.length
            const div = win.document.createElement('div')
            win.document.body.appendChild(div)
            div.innerHTML = '<iframe></iframe>'
            const iframeWindow = win[numberIframes]
            if (total == n) {
                parent = div
                parent.setAttribute('style', 'display:none')
            }
            n--
            if (!n) {
                parent.parentNode.removeChild(parent)
                return iframeWindow
            }
            return getIframeWindow(iframeWindow, {
                previous: win
            })
        })(context)
    }
    const w = getNestedIframes(20)
    console.log('canvas: ', window.document.createElement('canvas').toDataURL() == w.document.createElement('canvas').toDataURL())
})()

[abrahamjuliot]

this has potential in headless stealth test (currently effective)