Stored-XSS led to Keylogger injection

Hello everyone
Hope you’re doing well!

I was working on a project and found a Stored-XSS on it, but due to the use of HttpOnly property for the cookies, It was impossible to steal them using a script.
Also, It’s not wise to pass such a thing while It was a Stored-XSS, so I decided to exploit it any way possible.

All the users would see a similar panel after entering the application, and if, for example, the admin user …

cookies doing exploit hello injection keylogger led pass project script steal working xss