Iframe Src Redirect Extraction

merwiz · Nov 19, 2010

Here is a question for all the great minds. I have thought of a new idea for something but not sure if this is even possible due to cross site restrictions.

Basically lets say I create an iframe on siteA. On siteA I set the iframe src to siteB. When I goto siteA and it loads the iframe up, siteB does a redirect to siteC. Now on siteA is it possible to grab the siteC url as now the iframe src value has changed to siteC. Or because of cross domain restrictions, if I attempt to read the iframe src address, all that will return is siteB's address.

Hope that is clear enough.

JerrodMJames · Nov 27, 2010

what do you mean by that? generating traffic using iframe?

hyp959 · Nov 28, 2010

you can use cookies for tracking.....

iluvvegas · Nov 29, 2010

JerrodMJames said:
what do you mean by that? generating traffic using iframe?

i think he means by this... i wrote a post earlier how this one site is generating off my browser...i am too trying to figure it out how they do it... i dont want to really get rid of it.. but learned how they do it... but it seems it does it by cookies...

Code:

http://www.blackhatworld.com/blackhat-seo/general-scripting-chat/257111-script-affected-my-firefox-browser.html

Grizzy · Nov 30, 2010

merwiz said:
Here is a question for all the great minds. I have thought of a new idea for something but not sure if this is even possible due to cross site restrictions.

Basically lets say I create an iframe on siteA. On siteA I set the iframe src to siteB. When I goto siteA and it loads the iframe up, siteB does a redirect to siteC. Now on siteA is it possible to grab the siteC url as now the iframe src value has changed to siteC. Or because of cross domain restrictions, if I attempt to read the iframe src address, all that will return is siteB's address.

Hope that is clear enough.

Document.getElementById('yourframe').src will return siteB (no matter where it redirects to) and something like document.getElementById('yourframe').contentWindow.location.href will return a permission denied error in the console. Same origin policy prevents this becuase it would be a massive security hole. This shouldn't be possible, but of course no browser is perfect..

Iframe Src Redirect Extraction

merwiz

BANNED

JerrodMJames

Newbie

hyp959

Registered Member

iluvvegas

Regular Member

Grizzy

Senior Member

Main Menu

Marketplace

Making Money

BlackHat World