See Setting a Cookie using only HTML5

thank you, my question was about using set-cookie inside html not the meta tag

The meta tag is inside HTML. An no, a browser will not simply parse the body for HTTP headers.

thank you, the exploit is working so I think that the parsing has occurred, and yes I know that meta tag is inside the http message body.

I have no idea what the actual response (HTTP header and body) from the server was. But a browser will not interpret plainly given HTTP fields inside the HTTP body (as in your example code) as actual HTTP headers. So if the exploit works there need to be something else than this.

I see, One other thing I noticed when examining the repsponse with burp suite is that the Set-Cookie in response is written twice, once in the header and once in the body, I don't get it at all, Anyway I will add more data to the question.

The Set-cookie in the HTTP body is irrelevant here, what matters is the Set-Cookie in the header. As you can see there is a Set-Cookie in the header in the attempt to preserve the search entered by the user. But due to the search string having a newline inside ("test%0d%0aSet-Cookie ...") and improper input filtering/validation one is able to add another Set-Cookie header with a chosen content. This is also called a HTTP header injection attack.

AAAAA, I see,

Yes there is indeed a LastSearchTerm cookie, thank you very much. This means that the question by itself is wrong, should I delete it or rename it.

Given that it is based on a wrong assumption I would recommend to simply delete it

ok thank you again, by the way, can I ask you a more general question?

you can try. If it is easy to answer I'll do it here, otherwise it might be better posted as a real question.

there is a notion of sink and inputs in XSS, where are they in this case ?

This is no XSS

XSS means cross site scripting - there is no scripting involved here.

Ok, thanks.

But in general - the input (source) is where it comes from - which is your URL parameter for the search. The sink is where it ends up - which is your HTTP header

Yes, I have a lot to learn, I'm planing on finishing the websecurity academy, but what to do next, I don't know, sorry but do you recommand the next step for me since you are an expert?

I cannot give any recommendations. I never followed any specific carrier path, but just followed what interested me. There are many different areas in security so just read as much as you can and figure out what fascinates you the most.