PostMessage Xss Fuzz using Chrome App

;testing //
Oct 14 · 3 min read

Yes, it looks like ugly :’D but trust me, It really works what its name suggests.

Before going through the usage and installation, let me thank to Appcheck-ng for such a great tool which is converted to chrome app for offline use without depending on thirdparty server for logging our crucial/important messages.


  1. Install Tampermonkey
  2. Install the TampermonkeyScript “postmessage-hook.js”

Open “chrome://extensions” and click “Developer Mode” available in right side.

  1. Then drag “PostMessageMainTool.crx” to the screen and click add.
  2. Then click “Load unpacked” button and select the folder “PostMessage_ui_extension-kiran” (you can rename / put in any folder of your choice, i didn’t changed my name folder while uploading. sorry for that. ) it will add the PostmessageUI extension on screen i.e “P”.
extension icon

Tutorial on PostMessage Tool:

  1. First enable the PostmessageHook in Tampermonkey extension and start the “Postmessage” Tool installed in “chrome://apps” and click “start”

2. Load a site. Let me load google earth.

so, after finishing the load of Google earth in chrome, you will something like this

It loaded “8” mesage handlers to test for.

So, we got “8” messages to test for.

Now click on “P” icon in your toolbar and click on “Logger”. It will popup an UI where you need to click on “Dump Handlers”

Once it is there you can choose any URL to test further by clicking on “Replay” button.

Now start Playing !!!

You know what to do next right ? ;)


Hurray !!!!! (simpel text injection, but you can do much with this. Hope you guys like this.)

Thanks for reading this post. If you liked then please clap.

#bugbounty #BugHunting

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade