postMessage XSS lab
Pick an origin
Every participant runs on its own real origin — a separate hostname under pmlab.amir.baby, all served by this one server. Origin checks are genuine and a blocked message really is blocked.
Open the portal first, then the attacker pages — they must be different origins
for the attack to mean anything.
| URL | Role | Notes |
|---|---|---|
| https://victim.pmlab.amir.baby | Acme Portal | the application under test (victim) |
| https://widget.pmlab.amir.baby | Support Widget | legitimate third-party chat widget |
| https://trusted-domain.pmlab.amir.baby | Trusted Partner | legitimate partner, scenario 2 |
| https://attacker.trusted-domain.pmlab.amir.baby | Attacker Subdomain | attacker-controlled subdomain of the trusted domain |
| https://trusted-origin.pmlab.amir.baby | Trusted Origin | base host of the regex-validated domain |
| https://vendor.trusted-origin.pmlab.amir.baby | Vendor | legitimate partner, scenario 3 |
| https://attacker.com.trusted-origin.pmlab.amir.baby | Attacker (regex bypass) | host that slips past the weak regex |
| https://attacker.pmlab.amir.baby | Attacker | unrelated attacker origin |