Exploiting Cross-site Scripting to Steal Cookies Without Collaborator