Session Management
is how web application maintains and controls all user-interaction within the
application. From authentication and logging off - sessions are used to control all
interactions between clients & servers. Client-server sessions are
identified through a unique token often referred to as a Session ID or Cookie.
Just like everything else on the web, sessions can be exploited and one such
way is by using the created session by an authorized to our advantage.
If session
IDs/Cookies are created in a predictable way, we can easily duplicate a valid
cookies to "hijack the sessions of legitimate users".
So, first why are
cookies used? Their used because they are an easy way to keep track of a client
through multiple requests. It's how companies keep details about a certain
client. Cookies will last until they
expire or they are destroyed (by server or client). OWASP describes the main
advantages of as giving "a state to a stateless protocol like
HTTP". They store vital information
for websites and thus can be a target for hackers. The list below describes the patter for
"cookie hacking".
- Collect information about the cookie. Make sure to get a good sample
- Perform cookie reverse engineering - in other words, try to figure out the cookie generation algorithm.
- Manipulate cookies - once we figure out the algorithm, we can try to forge a valid cookie to attack the server.
Since the topic of
Cookies and sessions is broad, I want to limit the size of my posts - I will
continue on in the next post.
No comments:
Post a Comment