As per my understanding, while exploiting an XSS(in GET request) the attacker will craft the malicious link with js script payload and will send it to the victim, when the victim clicks on the link the script will send the cookie to attacker server. How can i exploit if the parameter is going in BODY. How exactly should i create a payload( link or file) and send it to the victim??
You can not craft a link that contains a POST body. So you will have to go a somewhat different route.
You will need to create your own page that contains the payload:
<form action="http://target.com" method="post" onload="this.submit()"> <input type="hidden" value="payload" name="fieldname"> </form>
This will be a little bit harder since the URL will be different and perhaps look a bit fishy. If you want to avoid that, you can go looking for open redirect vulnerabilities and leverage them to take the victim to your page.
Of course, if the payload is stored on the server, and displayed on a page that can be visited later, this is much simpler - just make the victim visit that page. This is what is called stored XSS.