I'm embedding an iframe on my site

< iframe id="demo" src="https://example.com" >

example.com has a cookie (not a http-only cookie)

How can I get the cookie?

  • 3
    You can't. At least not unless there is a bug somewhere (i.e. possible SSL sniffing, XSS, malicious browser extension...) or if this is a same-site iframe. – Steffen Ullrich Nov 22 '18 at 5:29

Assuming your site is not "example.com" (i.e. that this is a cross-origin iframe) and that there isn't a separate security vulnerability on example.com (such as cross-site scripting), you can't do this. It would violate the same-origin policy, which is a very major security boundary for browsers.

You could try attacking the network, but HTTPS is in the way. Assuming you have some way to capture or at least observe the victim's network traffic (such as DNS tampering, ARP spoofing on the local network, having control of the victim's router or other node on the path, etc.), you still need one of the following:

  • A trusted TLS certificate for example.com
  • A way to convince the client (browser) and server to accept a weak cipher suite, such as one using "export" encryption (or even RC4)
  • The server to be vulnerable to an attack such as BREACH, CRIME, POODLE, or similar
  • Some other as-yet undiscovered security vulnerability

Alternatively, if you have a network attacker position and the target site neither uses the "Secure" flag on its cookies nor uses HTTP Strict Transport Security (HSTS), you could have your iframe make a request to the HTTP version of the page instead, and steal cookies off the wire when it does.

You could also try attacking the server directly. If the server is vulnerable to Heartbleed, that's an easy way to steal somebody's cookies, though not necessarily those of the intended victim. Getting code execution on the server (through something like uploading a web shell or finding a command execution bug) would let you do whatever you wanted with the web server, at which point stealing cookies is often a waste of effort but technically possible.

Alternatively, for browsers not patched against Spectre or using site isolation (where each site's data is in its own process), you could use Spectre to attack the client and steal the cookies that way.

Basically, though, using only the tools you've described and assuming an otherwise-secure system, it can't be done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.