> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/xss-contexts/lab-5.md).

# Lab 5

So we have XSS, what do we do it with it? One way is to get its cookie! There's two main ways - using Burp Suite Collab / Without It 

<figure><img src="/files/OoZzUJMgvzwv1SDRztJw" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/rjzWbIKoVyJ6tF4A9UR5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/rtlfQedWTAf812MHtIhd" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/jR3yxlOk1QaLenSf9UHi" alt=""><figcaption></figcaption></figure>

What the payload does is first: fetches a link. &#x20;

{% hint style="info" %}
Fetch is the modern replacement for [`XMLHttpRequest`](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest): unlike `XMLHttpRequest`, which uses callbacks, Fetch is promise-based and is integrated with features of the modern web such as [service workers](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API) and [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS).
{% endhint %}

`fetch()`'s second argument is a config object with request options: `fetch(url, options)`

**`method: 'POST'`**\
Tells the browser to send this as an HTTP POST request rather than the default GET. POST lets you attach a body (GET requests technically can have bodies but it's non-standard and often stripped).

**`mode: 'no-cors'`**\
This is the important one for XSS exploitation. Normally, cross-origin requests (requesting a domain different from the page you're on) are subject to **CORS** (Cross-Origin Resource Sharing) restrictions — the browser will block the *response* from being read by your JS unless the target server explicitly allows it via CORS headers.

`no-cors` mode says: "I don't care about reading the response, I just want to *send* this request." The browser will happily fire it off without needing permission from the target server. Since your goal here is just exfiltration (sending data out), not reading anything back, `no-cors` is exactly what you want — it sidesteps CORS entirely for this purpose.

**`body: document.cookie`**\
This is the actual payload being sent in the POST request body. `document.cookie` is a JavaScript property that returns all **non-HttpOnly** cookies accessible to the current page, as a single string like:

For the script above, we created a object that made a key-pair list that listed all of the options. They could also work. Just know that **fetch() only has 2 positional parameters** which means that if we want more than just one we need to pass an object.&#x20;