> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/pentesting-web/postmessage-vulnerabilities.md). # PostMessage Vulnerabilities ## **PostMessages wildcards** **PostMessage** uses the following function to send a message: ```javascript targetWindow.postMessage(message, targetOrigin, [transfer]); ``` Check that **targetOrigin** could be a url like , so the messages can only be sent to that user (secure). Or it cloud be a wildcard "**\***". In case a wildcard is used, messages could be sent to any domain. ### Attack In [**this report**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) you can read how you could **iframe a page** that at some point may **sent** a **postmessage** using a **wildcard as targetOrigin** and **modify it's location so the data will be sent to an arbitrary domain**. In order to be able to perform this attack **X-Frame header must not be present** in the vuln page. ```markup