The other day I found a XSS vulnerability in a website that a friend told me to Pentest. It was a page from a school that he's managing, so the important thing here is the login credentials == COOKIES.
In this testing, I found that the cookies were HTTP Only, so I tested with a
alert(document.cookie) = The alert was blank.
I knew that the cookie was
userSession and the value was
But that means that XSS is not for cookie stealing anymore?
Or maybe I'm out of date for new security stuff? Or is there another technique to steal HTTP Only cookies?