Exploiting Cross-site Scripting to Steal Cookies Without Collaborator

We look at a XSS attack that steals cookies based on Burp's web security lab with the title 'Exploiting cross-site scripting to steal cookies'.

This lab is designed to be solved with Burp collaborator but this is only available in the professional edition in Burp. There is an alternative solution that does not involve Burp collaborator but it's quite a bit harder and involves an additional CSRF vulnerability.

We walk through the alternative harder solution to this lab which does not require Burp collaborator. Once the cookies is stolen we then transition into an active session hijacking attack for a full account takeover.

Exploiting Cross-site Scripting to Steal Cookies (Without Burp Collaborator - Alternative Solution)

Support This Channel
======================

Please like and subscribe, it means a lot!

Please buy me a coffee so I can continue to make content.

Join our Discord

00:00 Introduction
00:35 Burp collaborator
01:49 General XSS attack procedure
03:53 Exploring the lab
06:13 Post comment http request
07:40 Bypassing CSRF protection
09:47 Writing an exploit
14:14 Submitting the payload
15:20 Session hijacking
16:06 Lab summary

[austynstephens]

I love your content, you're the only one that actually explains in detail why and how, I really appreciate all the time that you invested in creating these tutorials.

[thomyhr]

Thank you! Love how clearly you explain this. Will definitely watch more of your content.

[vaibhavsuri]

The script is not working this time on burp acadmy

[FahadMuneer-dc]

how do we know that this cookie will allow us to access session because usually cookies are set as "httponly" which are secure and can not be used to gain access

[amaljose]

Can anyone explain how we got admin acces by changing the cookie