// HackTricks · Web Pentesting

Cookie Bomb

Cookie Bomb

A cookie bomb fills a user’s cookie jar with enough data that subsequent requests to a target origin carry an oversized Cookie header. If an intermediary or application rejects those requests, the affected user can be locked out of the site while other users remain unaffected. Broad cookie scope can extend the impact to related subdomains.[1][2]

HackerOne report 57356 provides a practical example of this user-specific denial of service.[1]

For broader background on cookie-based attacks and browser limits, see The Cookie Monster in Your Browsers.[2]

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.