Lab: DOM-based cookie manipulation
Summary: This PortSwigger lab demonstrates DOM-based client-side cookie manipulation, in which an iframe loads a product page URL with a JavaScript payload appended so the browser saves that malicious URL as the lastViewedProduct cookie. An onload handler then redirects the victim to the home page, where the poisoned cookie causes the payload to execute and call print().
Bottom line: The attack needs no server-side flaw: a cookie written by client-side script on one page carries the payload to a different page, and the redirect leaves the victim unaware the manipulation occurred.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026