A WordPress plugin that loads a set of iframe busters for popular ad networks.

• Download the plugin from WordPress.org.

Have you found a bug, or have a feature request? Github pull requests are warmly received. :)

The following are common XSS vulnerabilities found in iFrame busters.

1. Unescaped URL parameter values
2. Parameters that accept any domain

Special characters should be removed or converted into their equivalent HTML/hex entity. The characters in the following table can be used to write malicious code on the page.

example.com/iframebuster.html?parameter="></script><script>alert('XSS')</script>

Character => HTML Entity
    &     =>    &   
    <     =>    &lt;    
    >     =>    &gt;    
    "     =>    &quot;  
    '     =>    &#x27;  
    /     =>    &#x2F;  

When passing a domain as a parameter to write a script tag onto the page, it should be restricted to an approved domain(s).

example.com/iframebuster.html?server=evildomain.com

• DARTIframe.html
• ifr_b.html
• Pictela_iframeproxy.html

Further guidelines can be found at ha.ckers.org/xss.html, which covers the above rules as well as many others.