Tag Info

New answers tagged


Because the JavaScript will be running from a different origin - the Same Origin Policy will prevent example.org from grabbing the cookies from bank.example.com. Example.org does not even have to have been compromised. A Man-In-The-Middle attacker (let's call her Mallory) could have intercepted a connection from the victim (let's call him Bob) to the benign ...


In addition to Neil's answer if a cookie is marked as HttpOnly it will be inaccessible via javascript and therefore you cannot pass it on to the evil server.


The JavaScript is not injected on bank.com, it's run on compromised.com that you visit or are tricked into visiting. The JavaScript on compromised.com makes requests to bank.com on your behalf. The attacker must also be able to view your network traffic, such as at a Wi-Fi hotspot.

Top 50 recent answers are included