I believe I was a recent victim to an XSS script that gathered my cookies; however, I am not for sure certain. I am wondering if there is any way for me to check (I removed all my cookies).
There is no easy way to check if you as a site visitor, not a webadmin has been the victim of an XSS attack.
If it was a reflected attack (which means that the payload would be in the URL) you can look through your browsing history and see if you find anything that looks like and XSS payload in the URL:s to the site in question that you have visited.
If it was a stored attack, you would have to go through the source code of the pages you have visited and try to determine what the code does and if there is any fishy things going on. That is quite a big project and would require a lot of knowledge about web development.
If you are worried specifically about cookie theft you could visit the site again (be sure not to enter any sensitive info) and see what cookies it set, and if they are marked with
HttpOnly. If they are, they can not be stolen with XSS. However, there are many other evil things (like keylogging) that you can do with XSS so I am not sure this would be a meaningful exercise.
Can an attacker still receive your cookies by inserting a XSS script on a HTTPS based website?
HTTPS does not protect against XSS in any way - it is not what it is designed to do. HTTPS protects your data from sniffing or fiddling while in transit from the server to the client. XSS, on the other hand, fools the server to send you a script before the data reaches the TLS layer and is encrypted.
How could they receive my credit card cookie details if the website is HTTPS based?
See above. But it important to understand that credit cards should never be stored in cookies. Doing so is a horrible practice, and I would guess a violation of PCI. (That does not mean XSS could not be used to steal credit card details - it can, even if the info is not in cookies.)
Any advice or answers will help, thanks.
My answer might not be very encouraging for you. The short version is that it is very hard for you to know if you have been the victim of an XSS attack.
So what I would do instead is contact the site in question, explain to them why you are worried (e.g. about the warning your friend recieved) and ask them if they are aware of any problems.
Some other precautions you can take is:
- Change your password on the site.
- If you can check your login history (or any other history of actions like purchases), do so and see if there are anything you did not do.