search

aszx87410 / writeups-review

1 stars 0 forks source link

HITCON CMT 2019 - The cookie monster in your browsers #5

Open aszx87410 opened 3 years ago

aszx87410 commented 3 years ago

https://www.youtube.com/watch?v=njQcVWPB1is&ab_channel=HITCON

Cookie bomb

把 cookie 塞滿然後導致 server 回傳 413，達成 client side DoS

洗掉 Cookie

利用瀏覽器儲存 cookie 的上限把 HTTP only 的 cookie 洗掉

Cookie tossing

從 subdomain/其他 domain 設置 cookie 然後影響到其他 domain

aszx87410 commented 3 years ago

https://speakerdeck.com/filedescriptor/the-cookie-monster-in-your-browsers?slide=47