Steal Web Session Cookie
Stealing another user's session cookie (usually through XSS) to log in as them.
How it shows up on Hack The Box
On HTB there is an admin bot that visits whatever you submit: an XSS that sends document.cookie to your server gives you its session, if the cookie is not HttpOnly.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- XSS in CTFs: steal the admin cookie with a blind XSS 3 min read How to find an XSS, bypass the usual filters and steal the administrator's cookie with a blind XSS, just like on Hack The Box machines.