Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Exploit cross-site scripting to steal cookies with a custom data sink

Andrei | Last updated: May 16, 2020 08:01PM UTC

Hi, In the lab it's mentioned you can post the cookie in the post. However I can see the lab blog has a CSRF token so I probably can't make the "user" post inside the fake blog. I thus created a website which received data from the injected js. It works when I visit the page but I don't get any extra data. Is that limited to burp suit collaborate only? Thanks!

Liam, PortSwigger Agent | Last updated: May 18, 2020 07:55AM UTC

Hi Andrei. Yes, you need the collaborator and this tool is only available in the professional version.

Andrei | Last updated: May 19, 2020 03:34AM UTC