Menu
From what I understand document.cookie only gets your cookies for the current site you are on. Would it be possible for a malicious site to get around this by using an iFrame, modifying my HTTP header, making a request to the target site or some other method?
905
They allow sites to remember you, your website logins, and shopping carts so you can pick back up where you left off from your last visit. However, cybercriminals can manipulate HTTP cookies to spy on your online activity and steal your personal information.
A cookie can only be read by the site that created it Any cookie on your computer can only be read by the website that created that cookie. Web browsers are very strict about enforcing this.
How Hackers Steal Cookies. Browsers allow users to maintain authentication, remember passwords and autofill forms. That might seem convenient, but attackers can exploit this functionality to steal credentials and skip the login challenge. Behind the scenes, browsers use SQLite database files that contain cookies.
Once a hacker gains access to your session cookies, they can basically act as you. If you're logged in to your bank account, for example, they can set up a transfer to drain your account and move the funds into their own, and then they can change the password so you can't access the bank account at all.
One way to do this would be through cross-site scripting attacks. This is a short overview of how cookie-stealing works with XSS.
178
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
