New answers tagged


If you can execute an XSS on the application, you should be able to get the user session cookies if the user is logged in and has clicked the link with the payload. Use a GET request inside your XSS payload to your server to capture those cookies. CSRF token is definetly not enough to conduct any further meaningful attacks.

Top 50 recent answers are included