---
# System prepended metadata

title: 反射型xss(post)

---

# 反射型xss(post)
- 沒辦法像GET 一樣 將payload用到URL上
- 在框框出入文字，URL並沒有改變  --> POST型
![image](https://hackmd.io/_uploads/r1h522RLa.png)
- 方法一
	- 登入之後(admin/123456)，提示說需要得到他的cookie
	- 注入代碼``<script>alert(document.cookie)</script>``到對話框
	![image](https://hackmd.io/_uploads/Bknin3AL6.png)

- 方法二
	- 點擊[連結](http://127.0.0.1/pikachu-master/pkxss/xcookie/post.html)就可以得到cookies
	![image](https://hackmd.io/_uploads/BkX3hnR8p.png)

	- 源代碼
		- /opt/lampp/htdocs/pikachu-master/pkxss/xcookie 裡的 post.html
			![image](https://hackmd.io/_uploads/rJ92h208a.png)