Obtaining session cookies through XSS
We have already talked about Cross Site Scripting (XSS), it is one of the most common web attacks nowadays. XSS can be used to trick the users to provide credentials by simulating login pages, to gather information by executing client-side commands, or to hijack sessions by obtaining session cookies and impersonating their legitimate owners in the attacker's browsers.
In this recipe, we will take advantage of a persistent XSS vulnerability to obtain the session cookie of a user and then use that cookie to hijack the session by implanting it in another browser, and then executing actions impersonating the user.
For this recipe, we will set up a web server that will act as our cookie gatherer; so, ...