2 Made XSS point more clear to make it less broad.
source | link

Session hijacking - is Is there another way than session hijacking to access user account through XSS?

I'm wondering if thereIf I have discovered an XSS vulnerability, is there another way of gaining access to an account, without session hijacking - mainly? Mainly because on most of the sites I test, havethe HttpOnly &and Secure flags are set on the sessionIDsession ID, so I can't access the sessionIDit through javascript (document.cookiedocument.cookie). I know I could do some fake form asking for the username &and password, but is there another way? Preferably through xss

Session hijacking - is there another way?

I'm wondering if there is another way of gaining access to an account, without session hijacking - mainly because most of the sites I test, have HttpOnly & Secure set on the sessionID, so I can't access the sessionID through javascript (document.cookie). I know I could do some fake form asking for the username & password, but is there another way? Preferably through xss

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are set on the session ID, so I can't access it through javascript (document.cookie). I know I could do some fake form asking for the username and password, but is there another way?

1
source | link

Session hijacking - is there another way?

I'm wondering if there is another way of gaining access to an account, without session hijacking - mainly because most of the sites I test, have HttpOnly & Secure set on the sessionID, so I can't access the sessionID through javascript (document.cookie). I know I could do some fake form asking for the username & password, but is there another way? Preferably through xss