Cookie Stealing Attack in MVC Application

In today's blog post, I am going to discuss what cookie stealing attack is and how we can prevent it.

Cookie

Cookie is a small piece of data sent by a web server to a web browser. The browser stores this data in a text file. This data is sent by the browser to the web server each time it requests a page from that server.
Cookies store information like your site preferences or history so that they can customize the page for you, every time you request it. So that information is usually not what attacker cares about. Cookies are also used to store information that uniquely identify the user such as the Authentication Ticket. That's more luring to the attacker ;) If the attacker can steal someone's authentication cookie they can simply get access to the complete account.

Cookie Stealing using XSS

In order to steal the cookie, the attacker can write a script which reads all the cookies and sends it to the attacker. If you search about it on google, you can find plenty of scripts that read all the cookies and send it to a specific server.  If the site is XSS vulnerable, the attacker's task is made easy. He can simply get the script executed on anyone's machine and get all the cookies.
Once the attacker gets the authentication cookie, he can copy the Session Id/ Username, etc and plug that information into his own browser and get access to the victim's account. Isn't it simple?

How to Prevent?

In order to prevent the scripts to access the cookies we need to set the flag called HttpOnly to true. This allows the scripts to be accessed only by Http and disables all kinds of script access. We can set this flag at the application level in system.web section in web.config like this:
 
<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />

If we need to set it at per cookie level, we can set it like this:

Response.Cookies["ImpCookie"].HttpOnly=true;

Conclusion

Cookies can store valuable information and should be protected. We should set the cookie access to HttpOnly in order to prevent their access from malicious scripts.
For future updates to my weekly blog, please subscribe to the blog.

Secure Cookie in ASP.NET Application

In today's blog post, we will be discussing what the secure flag is on a cookie and why we should keep it set.

Secure Flag on Cookie

There is a boolean flag on the cookie called Secure which decides whether to send the cookie on an HTTP request or not. If the flag is set on the cookie, the cookie will not be sent on a regular Http request; it will be transmitted only on Https request.

Imagine if you have a web application which implements Https to be more secure. Once you login, the Authentication cookie (named as .AspNet.ApplicationCookie in my .NET Application) gets set. This cookie gets sent with each subsequent request to inform the server the identity of the logged in user.

If a man in the middle tries to view those requests, they will not be able to see anything as they are encrypted (Https). However, out of multiple requests, if there is even a single request on Http (for example for some resource like Javascript, image, css, etc), the attacker can see all the cookies (including authentication cookie). The attacker might be able to convince the user to successfully issue an Http Request through other means (social engineering). Such an Http request poses a serious security vulnerability as authentication cookie is exposed.
Using this authentication cookie, attacker can hijack the victim's session without victim ever even knowing about it.

How To Prevent

In an ASP.NET application, we can set the Secure flag by adding this to web.config:

<httpCookies requireSSL=true/>

This will set the Secure flag on all the cookies.
Or if we want to set it at per cookie level, we can set the HttpCookie.Secure property to true.

Conclusion

So we saw what the secure flag is on a cookie and why we should always set it in our application for cookies carrying sensitive information. This flag does not make the cookie secure from all types of attacks, however, this adds another layer of protection to keep our cookies more secure.
For future updates to my weekly blog, please subscribe to my blog via the "Subscribe By Email" feature at the right