11.7.6 (Incomplete)
Find a readable database configuration and read the password. The user we exploited in the XSS was not an administrator of the application. Use the database password to elevate privileges of the "v...
Read More
11.6.5 (Incomplete)
Capture any pre-filled passwords the user has saved in their browser. Send the captured credentials to the API Server.
Read More
11.6.4 (Incomplete)
Add the ability to store credentials and any accessible cookies that are obtained from an XSS victim. Some cookies might contain the HttpOnly attribute, making them inaccessible from JavaScript. Ho...
Read More
11.6.2
Change the form of the fake login page to prevent the form from loading a new page. Currently, if a user submits their credentials in the fake login page, we will not capture it and the user will b...
Read More
10.3.5
Create a script to parse the results of the XXE attack and cleanly display the file contents.
Read More
10.2.4
Update the token generator program to accept the start and stop values as command line parameters.
Read More
