How to Crack a Website - XSS, Cookies, Sessions

Informit.com provides an insiders look at a real life XSS attack and how it was used to bypass the authentication scheme of an online web application, leading to "shell" access, and admin account, and more. XSS attacks are often discussed in theory — this walk through illustrates just how dangerous these types of attacks can be in reality

If You Want to Crack Web-Site Then Just Follow The Situation:

1. User have to go for a Bad guy's website
2. User should have an account on the attacked website.
3. It will tell user want to log into the attacked website right after going to the bad guy website?

It is Sure That There will be a possible and a potential risk,even it would be highly-specific, probably only good if you are targeting user from the starting.