Lab: SameSite Strict BYPASS via sibling domain (no Burp Collaborator needed!)

[@jonnywoo8418]

Thank you so much It's still works in 2024!

[@netletic]

hi everyone! Here's the timestamps for this video: 00:00 - Intro 00:29 - View SameSite=strict Session Cookie 00:53 - Confirm WebSocket replies with entire chat history after READY message 01:35 - Confirm WebSocket is vulnerable to CSRF 02:19 - Discover our initial payload 03:25 - Write our initial payload 04:27 - Deliver our initial payload 05:25 - How we could bypass the SameSite=strict limitation 06:16 - Identify the sibling domain 06:52 - Confirm Reflected XSS vulnerability within sibling domain 07:29 - Login endpoint also accepts GET requests 07:45 - Try our initial payload via the sibling domain + reflected XSS 08:21 - Deliver our final payload to the victim 09:14 - Copy and clean the victim's base64 encoded chat logs 09:45 - View the decoded chat logs and solve the labs

[@gopikanna_]

Thank you for the amazing walkthrough..!

[@netletic]

thank you @gopikanna_! ☺️

[@Андрій-ь1э]

thank you

[@Jonathan-ng4vw]

Nice explaination, thanks.

[@netletic]

Cheers @Jonathan-ng4vw!

[@system_null]

Hii. ur underrated

[@netletic]

thanks null! ☺️

[@kallikantzaros]

thank you very much

[@LMeasy]

it doesnt work anymore, request is made only to /exploit by victim. something is not okay with the strict value, because if I visit URL manually then message is shown in logs, but if delivered to victim not

[@Th3psalm1st]

Yes it doesn't work. Can't see the bases64 values in the access log. The same for "SameSite Strict bypass via sibling domain" Lab. I think you must get burp pro to solve this now. Did you find another way?

[@LMeasy]

@@Th3psalm1st on the next day I tried again with newly created lab environment and worked fine. I guess somehow after a while the simulation of visitors gets buggy in the lab. Maybe if you try this hope this helps. I had like 3 labs like this where i could not finish due to exploit server bugs, and on the next day I tried same payload and worked xd

[@acronproject]

very good thanks

[@netletic]

Thank you @acronproject!

[@Nul1Secur1ty]

Yep ;) 😘

[@alperkaya8919]

I had a different and better solution but because of exploit server, it didnt work.