Cookie on parent domain
Set-Cookie without a tight Domain, or Domain=.target.com, plus a XSS or takeover on a forgotten subdomain.
Tags: cookie, xss, ato, takeover
Typical severity: P2-P4
What it becomes
A session cookie scoped to .target.com is an XSS-to-ATO gadget from any sibling subdomain you can script.
Where to look
SSO cookiesmarketing micrositeshelp.target.comstatus pages on the parent domain
Chains
- ATO via sibling XSS — XSS on docs.target.com reads document.cookie for .target.com and posts it.
- ATO via takeover — Dangling CNAME + cookie on parent domain = classic.
Notes
- HttpOnly stops JS read but not CSRF. SameSite=Lax is not a complete CSRF defence on GET-based actions.
- Cookie tossing / cookie bombing from a sibling is a related gadget on poorly parsed Cookie headers.