Contents
Cookie poisoning—also known as session hijacking—is an attack strategy in which the attacker alters, forges, hijacks, or otherwise “poisons” an otherwise valid cookie sent back to a server to steal data, bypass security, or both.
Cookie poisoning is the act of manipulating or forging a cookie (a small piece of data created and stored in a user’s browser that keeps track of important information regarding his or her session information for a particular site) for the purpose of bypassing security measures or sending false information to a server.
What can Attackers do with cookies?
Cookie poisoning is the act of manipulating or forging session cookies for the purpose of bypassing security measures and achieving impersonation and breach of privacy. By forging these cookies, an attacker can impersonate a valid client, and thus gain information and perform actions on behalf of the victim.
What is the main cause for cookie manipulation?
DOM-based cookie-manipulation vulnerabilities arise when a script writes attacker-controllable data into the value of a cookie. An attacker may be able to use this vulnerability to construct a URL that, if visited by another user, will set an arbitrary value in the user’s cookie.
Set your cookies to be Secure , so they can only sent over HTTPS. This will prevent all but the most sophisticated man-in-the-middle-attacks. This prevents the possibility of your user’s cookies being stolen if your site is vulnerable to XSS. Tamper-proof or encrypt cookie data, so manipulated cookie data is rejected.
While cookies cannot carry or install malware onto computers, they can be exploited by cybercriminals for their malicious schemes.
Are there any attacks that focus on cookies?
Most attacks that focus on cookies are related to session identifiers, which are most often stored and transmitted using cookies. Session cookies may be the target of different attacks, for example: Session hijacking: This type of attack aims to steal the user’s session identifier.
How are cookies used in session hijacking attacks?
As we discussed, when you login to a web application the server sets a temporary session cookie in your browser. This lets the remote server remember that you’re logged in and authenticated. Because this kind of attack requires the attacker to have knowledge of your session cookie, it’s also sometimes referred to as cookie hijacking.
A cookie poisoning attack is initiated by a user who manipulates the content of the cookie for their advantage before the cookie is sent to the web server. All that the user needs to do is to press F12 and use the user’s browser GUI to modify cookies.
One MFA attack is ‘pass the cookie,’ which allows threat actors to hijack browser cookies to authenticate as another user in a completely different browser session on another system, bypassing MFA checkpoints along the way. Cookies are powerful, and in some cases, more so than passwords.