Collected research
Stealing Basic Auth with Persistent XSS
Steals HTTP Basic credentials without cross-site tracing: many PHP installs leave a phpinfo() page that prints PHP_AUTH_USER and PHP_AUTH_PW. An XSS on the same host fetches that page with XMLHTTP, splits out the username and password, and exfiltrates both through an image src. Part 2 of the author's basic-auth series.
Record
- Researcher
- Mike Zusman
- Published by
- schmoil.blogspot.com
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Mike Zusman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .