TechKnowSurge

VideoSecurityFree

DEMO: iFrame Attacks

Iframes are a legitimate HTML feature used to embed content from external sources, but they can be exploited to host malicious code, facilitate adversary-in-the-middle attacks, and create convincing phishing sites that harvest user credentials.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Iframes are a standard HTML element that allows content from one website to be embedded and displayed within another, enabling common use cases like video embeds and third-party widgets. While the technology itself is benign, it presents several meaningful attack surfaces that threat actors have exploited in different ways over the years. Understanding how iframes work is foundational to recognizing and defending against the attack patterns built around them. One of the most historically significant abuses involved online advertising networks. Attackers submitted malware-laden advertisements to ad platforms, which then distributed those ads across thousands of legitimate websites. Visitors to those sites had malware silently delivered to their machines without any indication that the sites they trusted had been weaponized. This led advertising platforms to implement stricter vetting processes for submitted ad content, significantly reducing the effectiveness of this vector. Iframes are also used to construct phishing environments that are difficult to detect. An attacker can build a site that pulls an entire legitimate website into an iframe, making it appear that a user is visiting a trusted destination such as a bank or a familiar service. In reality, the attacker controls the outer page and can monitor and capture everything the user does, including login credentials. The only reliable indicators of this deception are typically a mismatched URL and subtle visual artifacts introduced by the iframe rendering, neither of which most users are trained to notice.

What you'll learn

Explain how iframes can be exploited to embed malicious content on legitimate websites or create deceptive spoofed sites that capture user data
Distinguish between legitimate iframe use cases and malicious iframe-based attack techniques, including malvertising and adversary-in-the-middle scenarios

What's covered

iFrames in Cyber Attacks

What Are iFrames
- Embed Cross-Site Content
- YouTube Video Example
Malicious Uses of iFrames
- Injecting Hidden Malware
  - Hacked Legitimate Sites
  - Users Unaware of Code
- Adversary in the Middle
- Data Collection
Malvertising Attacks
- Ad Networks as Vector
  - Google Ads Example
  - Malware in Ad Submissions
- Advertisers Now Screen Submissions
Fake Login Site Example
- iFrame Pulls Legitimate Site
  - Bank Login Spoofing
  - Attacker Collects Credentials
- Spotting the Fake Site
  - Different URL
  - Secondary Scrollbar Visible
- Few Lines of Code

Key terms

Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Iframe: An HTML element that embeds content from another webpage or source within a webpage, which can be exploited to inject malicious content or create deceptive spoofed sites.
Malvertising: A cyberattack technique that injects malicious code into legitimate online advertising networks to distribute malware to users visiting otherwise trusted websites.

Topics

Iframe Attacks Web Security Phishing Malvertising Adversary In The Middle Client Side Attacks

Transcript

Now, iframes aren't an attack in themselves, but can be utilized to carry out an attack.

Just a reminder that this is for educational and ethical hacking purposes only. This is to protect systems, not to compromise them.

What Iframes Are For

Iframes are really designed to pull together information from several different pages, or even several different sites. A good example of this is like YouTube. There are times when we want to bring a YouTube video into our website. Well, YouTube is a whole other site, so how do we get the YouTube video to play on our site? An iframe is one of the ways that we can do that.

What we see right here is website number one. In website number one, we want to embed an object into it from another site or another page. And so what we do is we go and get the embedded coding into that — in this case, we're going to use iframes right here — and then we're going to grab the information from website number two so we can display it on our website.

Malicious Iframes on a Legitimate Site

But they can be used for malicious purposes. One way is that there could be a legitimate website that has some iframes that are pointing to some sort of malicious code. So one thing that a hacker can do is hack the website and put this iframe in there, and then maybe the owners of the legitimate website and all the other users that are visiting this page don't realize that there's even some sort of malicious code on this site.

The reverse can happen as well. You could have a malicious site that pretends to be another site, so this is a legitimate site that's being used inside this malicious site. The advantage of this is that this malicious site can see all the activities and what's happening on the legitimate site.

Advertising Networks

One thing that was really common about 20 years ago is that we had websites that were offering some sort of advertising. They wanted to use advertising space on their website to make money. What they would do is they would go to some sort of service provider that did advertising — Google is an example of this — and so then Google could put their advertising on your website and you could make money off of that. People would click those links and then you would make money. So this is your website and you would have this advertisement.

And then what they would do is they would go and find all of these users that wanted to advertise. These users then would submit their advertisements to a place like Google, who would then advertise on your website. What would happen though is that adversaries were submitting malware onto these advertising companies, and then that malware would get embedded onto your site. So now people who visited your site would have this malware that would be installed on their machine or working on their machine, and this was problematic. This was something that commonly happened until these advertisers started making sure that what was being submitted didn't have any malware on it before they started advertising on these sites.

They would use these for compromising sites. They do adversary in the middle. They collect data. There's a lot of reasons why they would have this malicious code embedded on a website.

A Legitimate Site Inside a Malicious One

Let's look at the reverse. Let's say I have some sort of malicious site that I'm hosting, and then I am redirecting this traffic, or I'm using the iframe to really pull in all the data from a legitimate site. Maybe it's a bank account login. So now when you go to this site, you think that you're getting the legitimate site, but what you don't see is that it's actually my site and I'm collecting data as people log into these accounts.

Here's an example of this. I'm on what appears to be the TechKnowSurge website, and so it looks legitimate. Everything is set up exactly the way I have it set up on my actual website. But if you notice here, I'm not actually on the TechKnowSurge website. I'm on some sort of other site that I set up, but that is then pulling in through an iframe the data of my TechKnowSurge website. And so this can be very problematic.

In fact, on this other tab, I have my actual site. If you notice, there's just one slight little difference here — well, there's a couple of differences. One is the URL is a little different here. And then it happens to have this little secondary bar on the right side here. So that's really the only difference that we have between these two sites that's a sign that something is off.

This is the iframe.htm. So if you look at this setup, that's what this is referencing here: iframe.htm. And I brought this up so that way you could see the actual code. It's very simplistic in what it is. There's a couple of little style information here, and then this techknowsurge.com. So I have the iframe here. And really, I just needed the iframe, but to make it a little more convincing, I put a couple of other elements in here so that way it looked a little more like you're visiting the actual site.

So this is all there is. Just a few lines of code, and you can easily create this deceptive site where it looks like I'm on one site, but I'm actually on another site.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →