PT0-002 · Question #615
A penetration tester discovers a page on a company's website that has an XSS vulnerability and uses the following code to exploit it: The tester examines the logs on attacker.com and discovers that…
The correct answer is C. The session cookie has the HttpOnly flag set. The absence of the session cookie in collected data despite other cookies being present strongly suggests the HttpOnly flag is set on the session cookie.
Question
A penetration tester discovers a page on a company's website that has an XSS vulnerability and uses the following code to exploit it:
The tester examines the logs on attacker.com and discovers that some cookies have been collected but not the session cookie. Which of the following is the best explanation?
Options
- APOST requests are not logged by attacker.com.
- BThe XSS JavaScript uses document.cookie, not domain. cookie.
- CThe session cookie has the HttpOnly flag set.
- DThe <script> tag will not execute document write commands
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- C90% (18)
Why each option
The absence of the session cookie in collected data despite other cookies being present strongly suggests the HttpOnly flag is set on the session cookie.
Whether POST requests are logged by attacker.com is irrelevant to why a session cookie specifically wasn't collected through document.cookie, which typically involves a GET request to the attacker's server to exfiltrate the cookie string.
document.cookie is the standard JavaScript property used to access cookies accessible by the client-side script. There is no domain.cookie property in standard JavaScript for accessing cookies.
The HttpOnly flag is a security measure for cookies, preventing client-side scripts (like JavaScript injected via XSS) from accessing the cookie. If the session cookie has the HttpOnly flag set, then document.cookie in an XSS payload will not be able to read or transmit that specific cookie, even if other non-HttpOnly cookies are successfully exfiltrated. This explains why other cookies were collected but the crucial session cookie was not.
The <script> tag will absolutely execute document.write commands or any other valid JavaScript; this choice is factually incorrect regarding browser behavior.
Concept tested: XSS exploitation, HttpOnly cookie flag
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#httponly
Topics
Community Discussion
No community discussion yet for this question.