I've read about the XST attack, but the demonstration is just using a CURL or change the HTTP method to "TRACE" in the request.

Could anyone show me the POC/demo of how the attacker could stole victim's cookie using the XST vulnerability?

1 Answer 1


Modern browsers don't let you make TRACE requests with JavaScript, so it's generally not exploitable unless they have some kind of plugin that allows you to make arbitrary requests (things like ActiveX, Flash and Java used to do this). But if if you're in a position to run arbitrary code in one of those plugins, there's probably more interesting things you can do anyway.

However, some backend frameworks do allow the HTTP method to be overridden (see some discussion on this question), which could potentially allow you to exploit it on them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .