Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-25 06:00:40 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/stealing-sensitive-information-disclosure-from-a-web.md
CPol ad182f406f
GitBook: [master] 5 pages modified
2020-09-07 11:12:11 +00:00

1.1 KiB
Raw Blame History

Stealing Sensitive Information Disclosure from a Web

If at some point you find a web page that presents you sensitive information based on your session: Maybe it's reflecting cookies, or printing or CC details or any other sensitive information, you may try to steal it.
Here I present you the main ways to can try to achieve it:

  • CORS bypass: If you can bypass CORS headers you will be able to steal the information performing Ajax request for a malicious page.
  • ****XSS: If you find a XSS vulnerability on the page you may be able to abuse it to steal the information.
  • ****Danging Markup: If you cannot inject XSS tags you still may be able to steal the info using other regular HTML tags.
  • Clickjaking: If there is no protection against this attack, you may be able to trick the user into sending you the sensitive data an example [here](https://medium.com/bugbountywriteup/apache-example-servlet-leads-to-61a2720cac20).