I found a reflected XSS in a POST request that sends a file to the web server. The HTTP POST Request

The HTTP 200 OK Response

When I want to try to insert document.cookie in the payload, the web server detects the dot and breaks the injection because the extension is not good.

HTTP/1.1 200 OK
Date: Mon, 23 Nov 2020 19:35:22 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=7q0ec2d0mtb7sb09sun4224lgu; expires=Mon, 30-Nov-2020 19:35:22 GMT; Max-Age=604800; path=/; secure; HttpOnly
Vary: Accept-Encoding
Content-Length: 78
Connection: close
Content-Type: text/html; charset=UTF-8
{"error":"Les fichiers avec l'extention .cookie)> ne sont pas autoris\u00e9s"}

Is there a way to bypass this?

  • What payload have you tried so far? Also, if that is the cookie right there in the response, note that you won't be able to print it from Javascript since it has the HTTPOnly flag set. Nov 23, 2020 at 23:52
  • Unfortunately Questions asking us to break the security of a specific system for you are off-topic so I'm voting to close this question. If you want to ask questions about how to protect this system, for example "Is this validation sufficient or what extra validation should the server do?" that would be ok, but asking for help bypassing a security mechanism is not allowed here. Nov 24, 2020 at 4:25

1 Answer 1


To avoid using a dot, you could use document["cookie"] which is another way to write document.cookie. However, if (as multithr3at3d pointed out) you want to read the cookie in the response above, you won't be able to, as cookies with the HttpOnly flag set are not readable from javascript.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .