3 ms·

The browser doesn't send yahoo.com cookies to abysssec.com. The way XSS's work in general is that the attacker's landing page probably has an invisible iframe t

by mrb 14y ago

The browser doesn't send yahoo.com cookies to abysssec.com. The way XSS's work in general is that the attacker's landing page probably has an invisible iframe that GETs or POSTs to yahoo.com, with the right parameters, to trigger an XSS with js code that sends the cookies back to abysssec.com All this is invisible in the video, as the author does not want to disclose the technical details.

gcb0 14y ago
ah, ok. that's conveniently left out of the 'demo' ...but what was i expecting from a youtube video? thanks!
bcoates 14y ago
It sounds like disabling 3rd party cookies fixes this, right?
- dmix 14y ago
  The cookie is a first-party yahoo cookie that is sent via a GET parameter to a remote server in plain-text. So nope that won't help.