Lab: Exploiting cross-site scripting to steal cookies
Summary: PortSwigger's lab presents a stored XSS vulnerability in a blog comments function, where a simulated victim user views all comments after they are posted. The exercise requires injecting a payload that makes anyone viewing the comment send a POST request containing their session cookie to a Burp Collaborator subdomain, which the attacker then uses to impersonate the victim.
Why it matters: A single stored comment can hand over a live session cookie to an attacker, and the lab notes an alternative route that posts the victim's cookie publicly in a comment through CSRF - exposing both the credential and evidence the attack occurred.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026