Updated Steps to Reproduce

bugcrowd · Jan 23, 2025 · 1a498d0 · 1a498d0
1 parent be70924
commit 1a498d0
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/...itive_data_exposure/via_localstorage_sessionstorage/sensitive_token/template.md b/...itive_data_exposure/via_localstorage_sessionstorage/sensitive_token/template.md
@@ -9,7 +9,7 @@ This vulnerability can lead to data theft through the attacker’s ability to ma
 1. Use a browser to navigate to: {{URL}}
 1. Right click on the page, select Inspect, then select Storage, then Local (or Session) Storage
 1. Observe the exposed sensitive token: {{screenshot}}
-1. In a new browser window, perform {{action}} to show that the token in `localStorage`/`sessionStorage` can be used to generate a user session: {{screenshot}}
+1. In a new private browser window, perform {{action}} to show that the token in `localStorage`/`sessionStorage` can be used to access a user's session or data: {{replace these brackets with a screenshot}}
 
 **Proof of Concept (PoC)**
 

diff --git a/...description/sensitive_data_exposure/via_localstorage_sessionstorage/template.md b/...description/sensitive_data_exposure/via_localstorage_sessionstorage/template.md
@@ -9,7 +9,7 @@ This vulnerability can lead to data theft through the attacker’s ability to ac
 1. Use a browser to navigate to: {{URL}}
 1. Right click on the page, select Inspect, then select Storage, then Local (or Session) Storage
 1. Observe the exposed sensitive token: {{screenshot}}
-1. In a new browser window, perform {{action}} to show that the token in `localStorage`/`sessionStorage` can be used to generate a user session: {{screenshot}}
+1. In a new private browser window, perform {{action}} to show that the token in `localStorage`/`sessionStorage` can be used to access a user's session or data: {{replace these brackets with a screenshot}}
 
 **Proof of Concept (PoC)**