Cookie poisoning on habbo.com

This is for all furni lovers here. I used to be one of them, now habbo is just one of my many testing targets. Using some small misconfigurations and a xss hole in a sisterdomain of www.habbo.com, there used to be a way to poison cookies on www.habbo.com. I've made a video in which is shown how to do this. Although the xss leak is patched and this method doesn't work anymore, it still has some educational value.

Here's the video:

Habbo Cookie Poisoning from Auto Didact on Vimeo.