XSS Exploitation

1. Steal Cookies

Exploit XSS to send victims session cookie (on vuln domain) to attacker. Use this cookie to login as victim. - victim logged in. - application doesn't block JS access to cookies using HttpOnly flag. - cookies not tied to user IP. - session time-out.