Properties that are accessible on location

This vector attempts to see which properties are available on the parent location object of sandboxed iframe.

Created byhackvertor

Created Jun 7, 2024

Updated May 27, 2025

Detecting browser...

CategoryBrowser Quirks

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

const props = Object.getOwnPropertyNames(location);0x0D
props.forEach(prop => {0x0D
    try {0x0D
         if(typeof parent.location[prop] !== 'undefined') {0x0D
             log(prop);0x0D
          }0x0D
    } catch{}0x0D
})

Template used:

Properties that are accessible on location

Sample payloads

Fuzz results

Properties that are accessible on location

Sample payloads

Fuzz results

Distributed Fuzzing