Work I'm in this lecture we will learn how to find one another using cookies and cessions manipulation
techniques in this video lab demonstration.
I have used orderless be broken whenever a web application my bubbe suit already configured with the
burb with the browser.
Now let's select bug as broken authentication and session management then use a name enumeration and
then log in page yeah I've already registered with John user name profile.
That user name as John and password.
Let's turn on my intercept proxy
hit enter here you can see that in the proxy tab those that are perimeters
hit forward here you can see that two kids can be wheeled in the cookies had the user name as John user
ID as 26 and so on.
Now we can try to find vulnerability in each individual cookie one by one for this cookie one legibility
investigation ival is repeated all.
So let's send this request Really Peter here you can see that a better tool is blinking open up the
window or tab the key in the request can be edited easily in the buttons tab.
First investigate with the same request.
Yeah I'm not editing or modifying any cookies.
Go to butter the here you can see that in the response load in user is John.
Now let's send you a name and analyze.
That is vulgarity presented in the username cookie Last-Modified username cookies cookies value hit
Goldberga
you'll see that in the username tab.
Loudon user Asim let's try to modify it with you I.D. cookies
here to go over to
here you can see that logged in user as change.
This means that this web application is vulnerable for a cookie session.
We have logged in to the last application as Bryce
Laverty in user as Admin we have used the day cookies to manipulate the session and access and the record
OK and that's it.
In this video lecture thank you for watching and see you next lecture.