PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Stealing HttpOnly cookies with the cookie sandwich technique

portswigger.net | research | #cookies | #exfiltration | #session-security | #httponly | #tomcat | #cookie-parsing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.
Published
Collected

Related coverage

research · portswigger.net
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
research · portswigger.net
Inline Style Exfiltration: leaking data with chained CSS conditionals
Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.
research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Redefining Impossible: XSS without arbitrary JavaScript
Solving an 'impossible' XSS lab: with the payload confined to a single-quoted string and a tiny charset, Luan Herrera exfiltrates the cookie via side-channel techniques, not arbitrary JavaScript.
Back