Authenticated Data Theft
Posted: Sat Jun 16, 2018 10:07 am
I have numerous instances of data theft from sites where they have overly permissive crossdomain policies allowing for authenticated data to be POSTed back to an attacker server.
This is essentially CSRF, but with a twist. In some instances I can modify data, but I want to be able to report issues where I can steal data also. This doesn't fit into the template for reporting CSRF on OBB at present - any advice?
This is essentially CSRF, but with a twist. In some instances I can modify data, but I want to be able to report issues where I can steal data also. This doesn't fit into the template for reporting CSRF on OBB at present - any advice?