general
Blog post
Stealing HttpOnly cookies with the cookie sandwich technique
Source: PortSwigger Research · Published · Last checked 3 hours ago ·
Publisher excerpt From PortSwigger Research
In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.
Reference: PortSwigger Research — portswigger.net ↗