In today's blog post, I am going to discuss what cookie stealing attack is and how we can prevent it.
Cookies store information like your site preferences or history so that they can customize the page for you, every time you request it. So that information is usually not what attacker cares about. Cookies are also used to store information that uniquely identify the user such as the Authentication Ticket. That's more luring to the attacker ;) If the attacker can steal someone's authentication cookie they can simply get access to the complete account.
Once the attacker gets the authentication cookie, he can copy the Session Id/ Username, etc and plug that information into his own browser and get access to the victim's account. Isn't it simple?
<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />
If we need to set it at per cookie level, we can set it like this:
Response.Cookies["ImpCookie"].HttpOnly=true;
For future updates to my weekly blog, please subscribe to the blog.
Cookie
Cookie is a small piece of data sent by a web server to a web browser. The browser stores this data in a text file. This data is sent by the browser to the web server each time it requests a page from that server.Cookies store information like your site preferences or history so that they can customize the page for you, every time you request it. So that information is usually not what attacker cares about. Cookies are also used to store information that uniquely identify the user such as the Authentication Ticket. That's more luring to the attacker ;) If the attacker can steal someone's authentication cookie they can simply get access to the complete account.
Cookie Stealing using XSS
In order to steal the cookie, the attacker can write a script which reads all the cookies and sends it to the attacker. If you search about it on google, you can find plenty of scripts that read all the cookies and send it to a specific server. If the site is XSS vulnerable, the attacker's task is made easy. He can simply get the script executed on anyone's machine and get all the cookies.Once the attacker gets the authentication cookie, he can copy the Session Id/ Username, etc and plug that information into his own browser and get access to the victim's account. Isn't it simple?
How to Prevent?
In order to prevent the scripts to access the cookies we need to set the flag called HttpOnly to true. This allows the scripts to be accessed only by Http and disables all kinds of script access. We can set this flag at the application level in system.web section in web.config like this:<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />
If we need to set it at per cookie level, we can set it like this:
Response.Cookies["ImpCookie"].HttpOnly=true;
Conclusion
Cookies can store valuable information and should be protected. We should set the cookie access to HttpOnly in order to prevent their access from malicious scripts.For future updates to my weekly blog, please subscribe to the blog.
No comments:
Post a Comment