So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer:
You visit
https://secure.example.com/
which drops a cookie on your browser.You then visit
http://www.msn.com/
however a MITM inserts:<div style='visibility:hidden'> <iframe src='http://secure.example.com/'></iframe> <div>
MiTM sniffs your cookie from the request on the iframe
I am currently trying to duplicate the above steps.
Using a proxy tool like Burp, I am able to obtain the cookies and all header information.
I am wondering, how do I insert an iframe
with a HTTP website as a request?
Am I using the wrong tool?