A victim has two tabs open. One tab has an HTTPS site and one tab has HTTP site. What are the ways to attack HTTPS (
https://www.example.com) site from HTTP site (
Here is the one way that I think HTTPS site can be attacked:
If the HTTPS site is not using 'secure' attribute for its cookies, then including an
<img src='http://www.example.com/someimage.png'> in
http://somerandomdomain.com through MitM makes browser to send example.com's cookie in plain-text.
Any other attacks possible here?