Update account_takeover_checklist.md

dreamer1eh · Oct 31, 2021 · 798cc3e · 798cc3e
1 parent dcbbffc
commit 798cc3e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/account_takeover_checklist.md b/account_takeover_checklist.md
@@ -30,6 +30,7 @@
     - [ ] check if the application validates the OTP or Token
 
 - XSS to Account Takeover
+    - [ ] if the application does not use auth token or you can't access the cookies because the "HttpOnly" flag, you can obtain the CSRF token and craft a request to change the user's email or password       
 
     - [ ] try to exfiltrate the cookies