Now since we have a
general idea of Cookies, it's time to reverse engineer them. But before we do
this, we must first understand how to provide "a secure method of session
management". In other words, how do we keep our cookie safe? Well, the first
step is to make the data "hard-to guess" or unpredictable. In doing
this, we are making it hard to forge the cookie which makes it harder to break
into another user's session. To make it unpredictable, we have to create random
values or cryptography. Second step is
to make it tamper resistance. Having a cookie with a parameter isAdmin and
value "no" is not smart. It is extremely easy to temper with and
change the "no" to a
"yes". A better way of doing
it is encrypting the parameter and
value. Third step would to make sure the
cookie does expire at a certain point. Make the cookie only exists in the time
period that it should. Lastly, for important cookies, make sure to use the
secure flag so transmission of the cookie can only occur in an encrypted
channel.
If an application
follows the above guidelines when generating cookies, it will be extremely
difficult for hackers to temper with the cookies. Unfortunately, some cookies
are not this safe and that is why reverse engineering can be done. The basic
premise is that we get a handful of cookies from a website and look for
patterns. When collecting cookies, make
sure the website is in the same state for all cookies collected. For example,
if the first cookie collected was right after authentication, then the rest of
the cookies of the sample as to be collected at the same time. It is also important to note down the time
when the cookie was collected. As stated in the last post, the time the cookie
was created can be part of the cookie value.
When looking to
reverse engineer a cookie, it is good to know the value of type or types. Many
times, a cookie can hold numerous values of different types. Below is an example of a cookie.
ID=5a0acfc7ffeb919:CR=1:TM=1120514521:LM=1120514521:S=j3am5KzC4v01ba3q
In the next post,
we'll break down what each part of the cookie means.
No comments:
Post a Comment