Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Exploit cross-site scripting to steal cookies with a custom data sink

Andrei | Last updated: May 16, 2020 08:01PM UTC

Hi, In the lab it's mentioned you can post the cookie in the post. However I can see the lab blog has a CSRF token so I probably can't make the "user" post inside the fake blog. I thus created a website which received data from the injected js. It works when I visit the page but I don't get any extra data. Is that limited to burp suit collaborate only? Thanks!

Liam, PortSwigger Agent | Last updated: May 18, 2020 07:55AM UTC

Hi Andrei. Yes, you need the collaborator and this tool is only available in the professional version.

Andrei | Last updated: May 19, 2020 03:34AM UTC

Cool :) Thanks Liam.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.