So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer:

  1. You visit https://secure.example.com/ which drops a cookie on your browser.

  2. You then visit http://www.msn.com/ however a MITM inserts:

    <div style='visibility:hidden'>
       <iframe src='http://secure.example.com/'></iframe>
  3. MiTM sniffs your cookie from the request on the iframe

I am currently trying to duplicate the above steps.

Using a proxy tool like Burp, I am able to obtain the cookies and all header information. I am wondering, how do I insert an iframe with a HTTP website as a request?

Am I using the wrong tool?


You can do this using the Proxy tool (tab) of Burp. Just be sure that you added the host (msn.com in this case) to the Scope and check the "Intercept server responses..." check box on the Options tab (under Proxy).

This way all the server responses will be displayed on the Intercept tab where you can place arbitrary content in them.

You can also use the automatic Match and Replace feature under Proxy/Options.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.