Is it possible to get password from a site with stored XSS?
<div onclick="alert()">CLICK</div>). Is it possible to exploit this to get passwords?
There is no way to get the password directly
There are 2 ways to access an account from a XSS vulnerabilty
- As we saw, it isn't possible to directly get the passwords while the
user click on your link. But, think an other way. A first way is to
extract the users cookies. Using AJAX, you can send POST and GET
request in the background. The user will not be informed in this
request. Given this, you can send the cookies (get them with
- The second way refer to fake a login page. When clicking on your link, the user will think he has been disconnected while he just arrived on your fake page, which is still on the correct domain. This my answer about it there. You can there alter the page with your own source code, and send the ID to your server when the victim click on the connect button.