Properties that leak the parent URL even when sandboxed

This vector shows all the properties in window and document that contain a URL that leaks the parent URL even when sandboxed.

Created by: hackvertor

Created on: Thursday, June 6, 2024 at 11:25:57 AM

Updated on: Friday, July 19, 2024 at 3:45:11 AM

Vector type: JS

const regex = /(?:https?):\/\/shazzer[.]co[.]uk/;
Object.getOwnPropertyNames(window).forEach(prop => {
   try{
      regex.test(window[prop]+'')&&log('window.'+prop)
   }catch{}
});
for(const prop in document){
  try{
       regex.test(document[prop]+'')&&log('document.'+prop);
  } catch{}
}

1337