document.cookie). I know I could do some fake form asking for the username and password, but is there another way?
If you have XSS, you can perform any action on the website the user can. This can include changing the email address, adding a new user, or granting access to some resource. Whether any of these actions compromise the account depends on the web application.
For example, consider an XSS payload that changes the email adres of the current user to email@example.com. This may compromise the account if the web application has password reset functionality through email.
There are definitely more ways of hijacking a session of a victim. Think about
- Session Fixation
- Session Poisoning
- Cookie replay attacks
- Man in the Middle
At Session Fixation you are able to fix a session cookie before a user logs into a webpage. If the website isn't that secure it is possible that the server will accept your choosen cookie and don't generate a new one. If that occurs you know the cookie of the victim and are able to hijack his session. this can be achieved by a link or other techniques like XSS.
At Session poisoning some servers are misconfigured and write user data directly into the session key. So the victim can send a link or use other methods to hijack the session.
Cross site request forgery
As stated on wikipedia:
Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts.
TLDR; You can basically make a bad website which has some images embedded with links to the attacked site which are executing commands link altering the password or the username. More information can be found on the web.
Cookie replay attacks
This can happen when a user steals a valid cookie from a victim and uses it as their ones. This is basically the attack you described.
Man in the middle
If the site isn't using transport security you can intercept the traffic and steal all information from them. After that you can deliver the right credentials.