I'm trying to steal a Cookie using XSS in a training lab. The problem is that the server escapes my quotes and double quotes. So if I want to use this payload for instance:
No GET request is performed to "http://requestb.in/XXXXXXX" because of the
" getting escaped. (
' turns into
" turns into
'+String.fromCharCode(34)), thus the payload becomes:
So, which other means can one use to perform a Cookie Stealing in those conditions ?