BROWSER, ACCESS, DATA, COLLECTION, REDTEAM

Is your saved passwords were safe in browser?

In this article, I would like to share the server-side source code for stealing auto-fill saved passwords from modern browsers. It might be useful for Penetration testers or Red Teams.

Demo Steps:

  1. User’s should enter the dummy username/password from available form.
  2. Save the password in browser
  3. XSS code technique will steal password from auto-filled password field.
Server side-source code:
Server-side source code
PHP code

Demo Website

Public hosted Attacker Server - May takedown in future