I was wondering if it is possible to grab all the cookies for different websites through one XSS attack? For example, assume that twitter has a XSS vulnerability that an attacker exploited. Would the attacker be able to grab all the cookies that are stored in my browser from Facebook, Gmail, Yahoo etc by using the twitter XSS exploit?
No, because XSS means "Cross-Site Scripting".
Normally a site can only access cookies in its own Origin. This restriction is known as the Same Origin Policy.
example.org cannot normally access cookies in
If there is an XSS flaw on
example.com though, and the HttpOnly flag is not used on a cookie in
example.org can steal the cookies from
example.com if a user falls victim to the attack.
If this attack then allowed access to all browser cookies then the attacker would not need the XSS flaw at all - they would just write script in their own domain (
example.org in this case) if there were no Same Origin Policy restrictions.
An flaw that would allow access to all non-HttpOnly cookies, would be a "Universal XSS" vulnerability. uXSS is a flaw in a web browser or browser extension that allows the Same Origin Policy to be breached.
For instance, if we look at the cookies that Facebook sets when you request its homepage without being logged in:
$ curl --head https://www.facebook.com HTTP/1.1 200 OK ... Set-Cookie: fr=0a...Rvgc; expires=Wed, 12-Jul-2017 11:09:57 GMT; path=/; domain=.facebook.com; httponly
HttpOnly at the end of the
Set-Cookie header. If, in the browser context of Facebook (e.g. in the developer console) you access the object
fr. However, the browser will still store the cookie and send it along with every HTTP request made to