The XSS Rat
CWAP · Module 10 — Hidden Credentials

Attack 1 — Secrets in the JavaScript bundle

Animated, step-by-step: your browser already downloaded 100% of the front-end — grep it, un-bundle the source map, and read what the client was never meant to tell you.
Module 10Secret disclosureJS / source mapsMedium–High
—

—

—

◤ Attacker workstation

🐀
you
idle
—

◤ On the wire

◤ Server

key material
—
waiting
attacker
server
hunter@cwap — bash
1× 0:00 / 0:00 step 1 / 1