HITCON CMT 2019 - The cookie monster in your browsers
Channel: HITCON
Date: 2020-07-23

Don't you hate it when you find an XSS on an out-of-scope subdomain while bug bounty hunting? Worry not, this presentation will cover how to turn that out-of-scope XSS into a valid bug bounty report. Having some success in maximizing the impact of HTML injections on subdomains, I wanted to share the technical details behind my process. I will discuss abusing cookie specifications and browser/server tricks to achieve session fixation, OAuth token leaks, site-wide CSRF, and many more client-side issues. Real-life examples and findings will also be included in this talk.