Question

During a web application assessment, you discover that a comment field on a product review page reflects unsanitized input that persists and executes for every visitor who loads the page. Your goal is to demonstrate impact by capturing authenticated user session tokens. However, testing reveals that the application sets its session cookie with the HttpOnly flag. Which technique should you use to still demonstrate meaningful session-related impact from this stored XSS?

Accepted Answer

Use the XSS to force victims' authenticated browsers to perform sensitive actions or proxy requests through them (session riding)

Answer

Inject a script that reads document.cookie and exfiltrates the session token to your listener

Answer

Switch to a reflected XSS payload since HttpOnly does not apply to reflected contexts

Answer

Report the finding as informational only because HttpOnly makes stored XSS non-exploitable