Media Summary: The official writeup for the September '22 In this episode, we dive into one of the most ignored client-side vulnerability classes: René de Sain – renniepak - NahamCon 2025 Link to the slides:

Postmessage Xss - Detailed Analysis & Overview

The official writeup for the September '22 In this episode, we dive into one of the most ignored client-side vulnerability classes: René de Sain – renniepak - NahamCon 2025 Link to the slides: NahamCon2022EU is a virtual offensive security. This year's event was hosted by Farah Hawa & InsidePhD! Thank you to our ... DefCamp is the most important conference on Hacking & Information Security in Central and Eastern Europe, bringing hands-on ... Subscribe to BBRE Premium: ✉️ Sign up for the mailing list: Follow me on Twitter: ...

In this video, we break down a real Google Gmail vulnerability that involved iframes, Hello Due to the interest in my film "window.

Photo Gallery

A Quick Introduction to postMessage XSS
Postmessage XSS?! Solution to September '22 XSS Challenge
Client Side 01: postMessage Bugs
Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Origin Checks
#NahamCon2022EU: I Hope This Sticks: Analyzing ClipboardEvent Listeners for XSS by spaceraccoon
I Stole Session Cookies with postMessage DOM XSS
How I found DOM XSS via postMessage on Bing.com - Microsoft Bug Bounty
Abusing postMessage API for 6 figures/year at DefCamp 2021
Discovering DOM-Based XSS on DeepSeek.com via postMessage Exploitation
[Fixed] XSS via postmessage on zoho workdrive webapp
$25,000 Facebook.com postMessage account takeover vulnerability
How Gmail was Trusted ANY Website 😱 | postMessage XSS Explained with Demo
View Detailed Profile
A Quick Introduction to postMessage XSS

A Quick Introduction to postMessage XSS

Join us as we dive into the world of

Postmessage XSS?! Solution to September '22 XSS Challenge

Postmessage XSS?! Solution to September '22 XSS Challenge

The official writeup for the September '22

Client Side 01: postMessage Bugs

Client Side 01: postMessage Bugs

In this episode, we dive into one of the most ignored client-side vulnerability classes:

Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Origin Checks

Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Origin Checks

René de Sain – renniepak - NahamCon 2025 Link to the slides: https://0-a.nl/nahamcon/

#NahamCon2022EU: I Hope This Sticks: Analyzing ClipboardEvent Listeners for XSS by spaceraccoon

#NahamCon2022EU: I Hope This Sticks: Analyzing ClipboardEvent Listeners for XSS by spaceraccoon

NahamCon2022EU is a virtual offensive security. This year's event was hosted by Farah Hawa & InsidePhD! Thank you to our ...

I Stole Session Cookies with postMessage DOM XSS

I Stole Session Cookies with postMessage DOM XSS

I found a

How I found DOM XSS via postMessage on Bing.com - Microsoft Bug Bounty

How I found DOM XSS via postMessage on Bing.com - Microsoft Bug Bounty

View detail at: https://namcoder.com/blog/how-i-found-dom-

Abusing postMessage API for 6 figures/year at DefCamp 2021

Abusing postMessage API for 6 figures/year at DefCamp 2021

DefCamp is the most important conference on Hacking & Information Security in Central and Eastern Europe, bringing hands-on ...

Discovering DOM-Based XSS on DeepSeek.com via postMessage Exploitation

Discovering DOM-Based XSS on DeepSeek.com via postMessage Exploitation

While testing https://chat.deepseek.com, I found a DOM

[Fixed] XSS via postmessage on zoho workdrive webapp

[Fixed] XSS via postmessage on zoho workdrive webapp

It's possible for an attacker to achieve

$25,000 Facebook.com postMessage account takeover vulnerability

$25,000 Facebook.com postMessage account takeover vulnerability

Subscribe to BBRE Premium: https://bbre.dev/premium ✉️ Sign up for the mailing list: https://bbre.dev/nl Follow me on Twitter: ...

How Gmail was Trusted ANY Website 😱 | postMessage XSS Explained with Demo

How Gmail was Trusted ANY Website 😱 | postMessage XSS Explained with Demo

In this video, we break down a real Google Gmail vulnerability that involved iframes,

XSS window.postMessage + english subtitles

XSS window.postMessage + english subtitles

Hello Due to the interest in my film "window.