Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.
Suppose the site is https://www.example.com.
Still can there be any way?
HTTPS prevents MITM attacks. Consider:
1) you visit https://secure.example.com/ which drops a cookie on your browser
2) you then visit http://www.google.com/ however a MITM inserts
3) MITM sniffs your cookie from the request on the iframe
And then there's also the possibility of session fixation - where even if the cookie dropped by https://secure.example.com/ has the secure flag set, that's no use if it sends back a session id it received in a non-secure cookie (again set via MITM).
Agree with @symcbean, in addition here is an interesting session fixation technique:
First, the attacker goes to the website before the victim gets there so he can get a session cookie. Then, if the victim is still in HTTP for the same domain the attacker can set a cookie that will replay to the HTTPS website. So the attacker sets the same cookie that he just received into the victim’s browser. Once the victim authenticates, the cookie that the attacker gave the victim (and knows) is now valid for the victim’s account. Now if the victim was already authenticated or had already gotten a session token, no big deal. The attacker overwrites the cookie, which at worst logs the user out. Once the victim re-authenticates, voila - session fixation. Now all the attacker has to do is replay the same cookie in his own browser and he’s in the user’s account.