4 ms·
I wonder how easily you could have slipped in an obfuscated cookie stealer
by daenz 5y ago
I wonder how easily you could have slipped in an obfuscated cookie stealer
- schleck8 5y agoUTF-encode the maliscious snippet and disguise it as the regex pattern haha
- stavros 5y agoDoesn't UTF-8 just give you the exact same letters, since it's already ASCII?
- kroltan 5y agoI think it was meant to be UTF-8 escape codes, as in \u0000 etc.
- stavros 5y agoAhh that makes sense, thanks.
- tialaramex 5y agoPedantry: These are really Unicode escape codes not UTF-8 escape codes, since they're codes for Unicode code points. You can write invalid UTF-16 with these escapes (because unlike UTF-8 the UTF-16 encoding actually borrows Unicode code points that are not scalar values, called the "surrogates") but I don't know what the standard says should happen if you do that.
- zeusly 5y agoHN sets one cookie and that is "httpOnly" and "secure", so it can't be read from JavaScript. You can test this yourself by typing document.cookie into your console, it should return an empty string.
- usrbinbash 5y agoGiven that it takes about 20seconds to read through the snippet, not easily ;-)
- deleted 5y ago[deleted]
- neogodless 5y agoI'm trying to do this in Firefox 98.0 and I'm not able to. I see this in the console: > Scam Warning: Take care when pasting things you don’t understand. This could allow attackers to steal your identity or take control of your computer. Please type ‘allow pasting’ below (no need to press enter) to allow pasting. Oh now that I'm reading it carefully, I see there's a way to enable it!