Stealing Sensitive Information Disclosure from a Web
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
If at some point you find a web page that presents you sensitive information based on your session: Maybe it's reflecting cookies, or printing or CC details or any other sensitive information, you may try to steal it.
Here I present you the main ways to can try to achieve it:
- ​CORS bypass: If you can bypass CORS headers you will be able to steal the information performing Ajax request for a malicious page.
- ​XSS: If you find a XSS vulnerability on the page you may be able to abuse it to steal the information.
- ​Danging Markup: If you cannot inject XSS tags you still may be able to steal the info using other regular HTML tags.
- ​Clickjaking: If there is no protection against this attack, you may be able to trick the user into sending you the sensitive data (an example here).
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Last modified 4mo ago