Lab: Offline password cracking
Summary: This PortSwigger lab stores a user's password hash in a stay-logged-in cookie and includes a stored XSS vulnerability in the comment functionality. The exercise is to use the XSS to obtain Carlos's cookie, decode it in Burp Decoder, crack the password offline with a tool such as hashcat, then log in as Carlos and delete his account.
Bottom line: A cookie that carries a password hash turns a single XSS flaw into an offline cracking opportunity, and PortSwigger explicitly warns against submitting hashes of clients' real passwords to a search engine during testing.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026