# Sop Iframe Bypass
> How to exploit Same-Origin Policy (SOP) bypasses using iframes and null origins. Use this skill whenever the user mentions SOP bypass, iframe exploitation, null origin attacks, cross-origin message vulnerabilities, or needs to exploit XSS through iframe manipulation. This skill covers techniques for bypassing origin checks in postMessage handlers, exploiting sandboxed iframe behaviors, and chaining popup inheritance for origin spoofing.
- Skill: `abelrguezr/sop-iframe-bypass` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/sop-iframe-bypass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/sop-iframe-bypass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/sop-iframe-bypass
---
# SOP Bypass with Iframes
This skill covers techniques for bypassing Same-Origin Policy protections using iframe sandboxing and null origin exploitation.
## Core Concepts
### The Vulnerability Pattern
Many applications use `postMessage` with origin checks like this:
```javascript
onmessage = (e) => {
const data = e.data
if (e.origin !== window.origin && data.identifier !== identifier) return
// ... process message
}
```
The vulnerability exists when:
1. The origin check can be bypassed (e.g., both sides become `null`)
2. The identifier check can be satisfied or bypassed
3. The message handler executes untrusted content (XSS)
### Null Origin Exploitation
When a page is loaded in a **sandboxed iframe** without `allow-same-origin`, its `window.origin` becomes `null`.
**Key behaviors:**
- `
```
The iframe's `window.origin` becomes `null`, bypassing origin checks that compare against `window.origin`.
### Technique 2: Popup Inheritance Chain
When direct embedding isn't possible, use a popup chain:
1. Create a sandboxed iframe (origin = null)
2. Open a popup from the iframe to the target page
3. The popup inherits null origin
4. Both contexts can now communicate via postMessage
**Required sandbox flags:**
- `allow-scripts` - Execute JavaScript
- `allow-popups` - Open popup windows
- `allow-top-navigation` - Navigate the top window (if needed)
### Technique 3: Identifier Extraction and Relay
When the target requires an identifier check:
1. First message: Send payload to extract the identifier
2. Second message: Use the identifier to send the actual exploit
3. Chain through the top window if needed
## Exploit Template
### Basic Null Origin Exploit
```html
```
### Advanced: Identifier Extraction Chain
```javascript
// Step 1: Create sandboxed iframe
const iframe = document.createElement("iframe")
iframe.sandbox = "allow-scripts allow-popups allow-top-navigation"
// Step 2: Payload that extracts identifier and relays to top
const relayPayload = `
const target = opener.top;
target.postMessage(1, '*');
setTimeout(() => {
target.postMessage({
type: 'render',
identifier: 'KNOWN_IDENTIFIER',
body: '![]()
'
}, '*');
}, 1000);
`.replaceAll("\n", " ")
// Step 3: Initial communication
iframe.srcdoc = `