Bypassing Frame buster

Question

I need to bypass or bust a frame buster, but I don't have a server that returns 204. The best solution that works (partially so far) is the one in https://crypto.stanford.edu/~dabo/pubs/papers/framebust.pdf on page 4 section C, onBeforeUnload – 204 Flushing.

It is discussed here (Frame buster buster) and here (Frame Buster Buster ... buster code needed) and the code is reproduced below

<script type="text/javascript">
 var prevent_bust = 0 
 window.onbeforeunload = function() { prevent_bust++ } 
 setInterval(function() { 
 if (prevent_bust > 0) { 
 prevent_bust -= 2 
 window.top.location = 'http://example.org/page-which-responds-with-204' 
 } 
 }, 1) 
</script>

My problem is, I don't have a server that returns an HTTP status code 204 (and I cannot set one up). How do I get around this?

• Obsidian Age: Politely ask the owner of the site in question to allow you to display their website in an <iframe>?
• Steven: It may help to understand about frame busting restrictions owasp.org/www-pdf-archive//…
• Steven: This document was fairly informative crypto.stanford.edu/~dabo/pubs/papers/framebust.pdf

Answer 1

Since you can't set up your own server, you don't have many options aside from using a third party server. The obvious downside is that it's not under your control, so you can't control its availability.

A server whose purpose is to return various HTTP status codes will potentially be more reliable (as opposed to finding something random). You could use httpstat.us. The main page lists all the status codes and options it supports. The following will return HTTP 204: httpstat.us/204.