Web Siphoning Cookie

Inspired by the great work of Samy Karmar's : https://github.com/samyk/poisontap

Web Siphoning Cookie:

• Provide a Web page that charge multiple hidden iframes with different domain.
• When the iframes is loaded, the domain is spoofed and answer a javascript that grab the cookie for this domain.
• The cookies is send to the webserver that save it on the sdcard.

Limitations:

• Modern browser have limitations against this attack, Firefox use network.cookie.cookieBehavior in about:config to protect cookies if you put the value to 4, the attack is effective.
• Javascript may not be executed on all smartphone.

Workflow:

• Start portal.
• Choose XX-WebSiphonCookie.html.
• When page is loaded the script execute the attack and cookie are logged on SDcard.