Captured x-wb-session

Raw reusable bearer token leaked by the signed-in Capital One Shopping extension.

Attacker-captured token

Automatic capture pending 
Waiting for the extension...

Authenticated account data

Waiting for authenticated /api/v1/session response...

Waiting for the extension-created coupon iframe...

Proof details

Confidentiality

Automatic confidentiality proof pending.