JakeSkii

Thank you!

A video by WIRED came up in my YouTube feed about it.

Sent you an email!

Hi, I've sent you an email.

Thank you!

OP - Wow, can't believe I missed that! Thanks!

Interesting, thanks for the insight!

Thank you, will take a look!

Just to clarify, the PHPSESSID cookie was HttpOnly - I could extract the new value because I had overwritten it. Most of the cookies were set correctly (thankfully) however there was a lot of SPII stored in JS variables which I was able to get.

Around 4/5 hours if I recall correctly. It was over a year ago so not 100% sure.

OP - I'm honestly not sure what happened, it could be just based on the naming or something else to do with it. Either way, when I visited it, Googles Safe Browsing alert popped up with "Deceptive site ahead - recentley detected phishing".

OP Here - Like the others have said, it wasn't a proper same-origin check. We'll never know for sure how it was handled beacuse it was all done server-side but I'm guessing it was something like an if in statement on the FQDN, hence why I was able to get away with pointing it to my own domain.

Hi, OP here! Thank you all so much for the positive commments. To give some background: I'm a 17 year old student in the UK doing my A-Levels, still deciding what uni to go to and looking for degree apprenticeship options! You can checkout my github profile here -> https://github.com/Jayy001 (I'm one of the core members behind HashPals, creating Search-That-Hash as well as being a maintainer for the open-source repository of free software for the ReMarkable tablet)

This was one of my favorite security research findings and I decided to write my first ever blog post on it. Would love to hear everyones thoughts and any constructive criticism on it!