Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.
Suppose the site is https://www.example.com.
Still can there be any way?
HTTPS prevents MITM attacks. Consider:
1) you visit https://secure.example.com/ which drops a cookie on your browser
2) you then visit http://www.google.com/ however a MITM inserts
3) MITM sniffs your cookie from the request on the iframe
And then there's also the possibility of session fixation - where even if the cookie dropped by https://secure.example.com/ has the secure flag set, that's no use if it sends back a session id it received in a non-secure cookie (again set via MITM).
Agree with @symcbean, in addition here is an interesting session fixation technique: