You’ve probably heard of XSS. The javascript injection which will steal your cookie, bypassing the cross-domain policy implemented by browsers. Normally, you are not allowed to see the cookie of another site/control a user on another site.

However, if a site has XSS leaks, this does become possible. All you need is a way to inject javascript (clientscript) code onto the page. It does not even have to be saved on the site itself, simply an unfiltered echo $_GET['whatever']; will do.

Once you find this, you can steal the cookie and use it to act like the user. There are 2 options: either you use the cookie with a bot you wrote, or you mimic the user actions with javascript/ajax, since you can access javascript on the other site.

I’ll talk about sending the cookie to your bot, which will for example post a comment on a popular social network.

Let’s say the XSS hole you found is : http://www.othersite.com/input.php?txt=[whatever]
All you do is inject this piece of javascript code to attach the script to the current page:

This will send the cookie to cookiejar.php where we will catch the cookie and feed it to our bot.

Now the bot will send a comment under the user’s name. Ofcourse, this will use the same IP address for all the users you stole their cookie from. If you want to avoid this, mimic the behaviour in ajax.