还是exploit-db上的paper
Token Hijacking with XSS
https://files.cnblogs.com/noevil/TokenHijackingWithXSS.pdf
