5

I was wondering if it is possible to grab all the cookies for different websites through one XSS attack? For example, assume that twitter has a XSS vulnerability that an attacker exploited. Would the attacker be able to grab all the cookies that are stored in my browser from Facebook, Gmail, Yahoo etc by using the twitter XSS exploit?

  • It would be weird if that was possible. That would mean any malicious website could just access any cookies the user has. – Black Magic Apr 13 '17 at 13:46
  • 3
    You don't seem to understand what XSS is at all. You're essentially asking: "If Twitter can execute Javscript, can it access Facebook's cookies?" – Arminius Apr 13 '17 at 14:47
  • You are right,I am new to XSS and trying to understand hardly. – Analoggen hacker Apr 13 '17 at 14:49
  • yes, try running alert(document.cookie) in the devtool's console ([F12]); you see them all – dandavis Apr 14 '17 at 20:14
11

No, because XSS means "Cross-Site Scripting".

Normally a site can only access cookies in its own Origin. This restriction is known as the Same Origin Policy.

That is example.org cannot normally access cookies in example.com.

If there is an XSS flaw on example.com though, and the HttpOnly flag is not used on a cookie in example.com, then example.org can steal the cookies from example.com if a user falls victim to the attack.

If this attack then allowed access to all browser cookies then the attacker would not need the XSS flaw at all - they would just write script in their own domain (example.org in this case) if there were no Same Origin Policy restrictions.

An flaw that would allow access to all non-HttpOnly cookies, would be a "Universal XSS" vulnerability. uXSS is a flaw in a web browser or browser extension that allows the Same Origin Policy to be breached.

4

No, a malicious code on a website could only retrieve the cookies that have been set by this website (and its subdomains). Even in this case, cookies having the HttpOnly flag cannot be read by JavaScript code.

For instance, if we look at the cookies that Facebook sets when you request its homepage without being logged in:

$ curl --head https://www.facebook.com

HTTP/1.1 200 OK
...
Set-Cookie: fr=0a...Rvgc; 
            expires=Wed, 12-Jul-2017 11:09:57 GMT; 
            path=/; 
            domain=.facebook.com; 
            httponly

Note the HttpOnly at the end of the Set-Cookie header. If, in the browser context of Facebook (e.g. in the developer console) you access the object document.cookie via JavaScript, it won't contain the contents of the cookie fr. However, the browser will still store the cookie and send it along with every HTTP request made to *.facebook.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.