Exploiting Cross-site Scripting to Steal Cookies Without Collaborator
10.1 هزار بار بازدید -
پارسال
-
We look at a XSS
We look at a XSS attack that steals cookies based on Burp's web security lab with the title 'Exploiting cross-site scripting to steal cookies'.
This lab is designed to be solved with Burp collaborator but this is only available in the professional edition in Burp. There is an alternative solution that does not involve Burp collaborator but it's quite a bit harder and involves an additional CSRF vulnerability.
We walk through the alternative harder solution to this lab which does not require Burp collaborator. Once the cookies is stolen we then transition into an active session hijacking attack for a full account takeover.
Exploiting Cross-site Scripting to Steal Cookies (Without Burp Collaborator - Alternative Solution)
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
Join our Discord
Discord: discord
00:00 Introduction
00:35 Burp collaborator
01:49 General XSS attack procedure
03:53 Exploring the lab
06:13 Post comment http request
07:40 Bypassing CSRF protection
09:47 Writing an exploit
14:14 Submitting the payload
15:20 Session hijacking
16:06 Lab summary
This lab is designed to be solved with Burp collaborator but this is only available in the professional edition in Burp. There is an alternative solution that does not involve Burp collaborator but it's quite a bit harder and involves an additional CSRF vulnerability.
We walk through the alternative harder solution to this lab which does not require Burp collaborator. Once the cookies is stolen we then transition into an active session hijacking attack for a full account takeover.
Exploiting Cross-site Scripting to Steal Cookies (Without Burp Collaborator - Alternative Solution)
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
Join our Discord
Discord: discord
00:00 Introduction
00:35 Burp collaborator
01:49 General XSS attack procedure
03:53 Exploring the lab
06:13 Post comment http request
07:40 Bypassing CSRF protection
09:47 Writing an exploit
14:14 Submitting the payload
15:20 Session hijacking
16:06 Lab summary
پارسال
در تاریخ 1402/01/06 منتشر شده
است.
10,177
بـار بازدید شده