JakeSkii

Thank you!

A video by WIRED came up in my YouTube feed about it.

Sent you an email!

Hi, I've sent you an email.

Thank you!

OP - Wow, can't believe I missed that! Thanks!

Interesting, thanks for the insight!

Thank you, will take a look!

Just to clarify, the PHPSESSID cookie was HttpOnly - I could extract the new value because I had overwritten it. Most of the cookies were set correctly (thankfully) however there was a lot of SPII stored in JS variables which I was able to get.

Around 4/5 hours if I recall correctly. It was over a year ago so not 100% sure.

OP - I'm honestly not sure what happened, it could be just based on the naming or something else to do with it. Either way, when I visited it, Googles Safe Browsing alert popped up with "Deceptive site ahead - recentley detected phishing".

OP Here - Like the others have said, it wasn't a proper same-origin check. We'll never know for sure how it was handled beacuse it was all done server-side but I'm guessing it was something like an if in statement on the FQDN, hence why I was able to get away with pointing it to my own domain.

This was one of my favorite security research findings and I decided to write my first ever blog post on it. Would love to hear everyones thoughts and any constructive criticism on it!