I'm embedding an iframe on my site
< iframe id="demo" src="https://example.com" >
example.com has a cookie (not a http-only cookie)
How can I get the cookie?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Assuming your site is not "example.com" (i.e. that this is a cross-origin iframe) and that there isn't a separate security vulnerability on example.com (such as cross-site scripting), you can't do this. It would violate the same-origin policy, which is a very major security boundary for browsers.
You could try attacking the network, but HTTPS is in the way. Assuming you have some way to capture or at least observe the victim's network traffic (such as DNS tampering, ARP spoofing on the local network, having control of the victim's router or other node on the path, etc.), you still need one of the following:
Alternatively, if you have a network attacker position and the target site neither uses the "Secure" flag on its cookies nor uses HTTP Strict Transport Security (HSTS), you could have your iframe make a request to the HTTP version of the page instead, and steal cookies off the wire when it does.
You could also try attacking the server directly. If the server is vulnerable to Heartbleed, that's an easy way to steal somebody's cookies, though not necessarily those of the intended victim. Getting code execution on the server (through something like uploading a web shell or finding a command execution bug) would let you do whatever you wanted with the web server, at which point stealing cookies is often a waste of effort but technically possible.
Alternatively, for browsers not patched against Spectre or using site isolation (where each site's data is in its own process), you could use Spectre to attack the client and steal the cookies that way.
Basically, though, using only the tools you've described and assuming an otherwise-secure system, it can't be done.