daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

ss-leaks.md (1065B)

      1 ---
      2 title: "Same-Site Leaks (SS-Leaks)"
      3 section: "Web Pentesting"
      4 sectionSlug: "pentesting-web"
      5 sourcePath: "src/pentesting-web/dangling-markup-html-scriptless-injection/ss-leaks.md"
      6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/dangling-markup-html-scriptless-injection/ss-leaks.md"
      7 sha: "188de82beb54e70956b2952367a0af91d26758b8"
      8 isIndex: false
      9 modified: true
     10 license: "CC-BY-NC-4.0"
     11 ---
     12 
     13 # Same-Site Leaks (SS-Leaks)
     14 
     15 Same-site leaks (SS-Leaks) adapt cross-site leak techniques to HTML injection on the target site. The linked research uses nested `<object>` fallbacks, lazy loading, and responsive images to convert differences such as HTTP `200` versus `404` responses into requests to an attacker-controlled endpoint, even when `SameSite=Lax` cookies and a restrictive Content Security Policy prevent simpler XS-Leak techniques.<sup>[[1]](#references)</sup>
     16 
     17 ## References
     18 
     19 - [1] [Zeyu Zhang - From XS-Leaks to SS-Leaks](https://infosec.zeyu2001.com/2023/from-xs-leaks-to-ss-leaks)