Welcome back in this but it is light. It would take a
look at two different types of issues session persistence. As
we previously looked at assume protocol being stateless. We
need to find mechanisms in order to pursue sessions.
So that each user can be declared by
and the response can be sent from the server.
So in this module, you will not be taking a look at the development
per se, but just to identify the
common concerns and to understand how we can leverage those
mechanisms and attack two scenarios.
So, the common types of search implementation that we see are
via cookies, followed by such and
Heidi pass where the URL and last being threatened
forms. So, let's take a look at
the first case scenario cookies. So, what are cookies? The
cookies are a small file, which is actually
being downloaded to your computer via the browser. This
is something that is used by the server covid-19
the user so that they can access different
services and resources.
Now, let's look at a small demo.
So, as you can see, this is a small code snippet that I've
written for PHP, cookie based, social management. So
let's try to
Dig deep into the developer tools, so
just press F12.
So just formed the demo purpose. I will clear out
all the existing cookies.
Now, let's try to refresh the page.
As we can see, a cookie has not been set on
the first request, and it was generated.
So what does that mean? A particular file has been downloaded to
your computer with the cookie. Having the name user with
the value of the username itself and
that as a expiry date for a given time. In this
particular scenario. It is for a date.
Now, let's try to access the request again.
As you can see, on subsequent requests that could be
was sent to the server. And for each request, it was able
to identify.
Who the user is actually tanker request?
So one of the common advantages of the scenario is that even
if the user actually closes
the browser itself since the
cookie is stored on the computer, the server can
actually recognize for each request. Let's try to figure that
out.
I'm just trying to open up a new window and
setting out the request. Again in
this scenario. We can see on the first request itself. The
so was able to identify who the user was.
Unlike the previous scenario where I cleared out cooking and
on the first request, it was not able to validate the
cookie itself.
I will look at the advantages for this. This is something can
be used for each request and
two-person session for a longer duration since the
cookie can always have a long expiry time.
And Second, Use case would be what we saw in
the demo. That if the user, even though equals out the
processor, you can always login back since as
long as assertion is valid or the cookie is alive. Patient,
x 5 time, so session will be
reactivated. There are some drawbacks to that.
Also. The first drawback would be the user can
always maintained, only one user session.
In case their applications web user has
multiple accounts. Since the cookie will actually
be dragged back and you can always
login using only one browser. There
are alternative ways to do. So we be using different browsers or
actually using incognito mode can be used. Second
drawback is that if the cookies are not actually secured
in terms of the properties, then there
are additional web attacks such as cross-site scripting that
can be used to leverage and steal those cookies.
To something. We'll be taking a look at the handout section.
Now, let's look at the
second scenario where this cookie or
the session ID itself as is being passed both
the URL.
So this is again one such demo in which the
small code snippet, which shows that on
each request or unique be free session ID
is being signed to the server and which is something that
will be used.
So, these are the scenarios where?
Browser. Or the end-users client. Might
not support cookies. These are very useful on those scenarios. The
way we can see for each request for new session ID would be generated
and the same value would be used for the particular
user login session.
So the major advantage would be that multiple or
parallel sessions can be used. Since for
each request, a new such an ID would be generated and
these are mostly used in the cases where cookies are
not being supported.
Similarly, there are drawbacks to this as well. First off,
by could be that if the session is being closed or
the browser is closed, user cannot login since it was
maintained for that particular tab. So window, in
second drawback is that since the
session ID itself is being passed for the URL. So
all the web request is being logged over the access logs
or there might be additional devices and
actually cash each and every request
and store them.
That way, it is information disclosure where an active session
might be disclosed for any user or any attacker.
Now, let's take a look at Alaska scenario where I
need them for me is being used.
So this is under such code snippet in which we
are using a need inform. Now, let's try to
to inspect the form itself just for demo purposes have
actually pre-fill the form values.
If I use a developer tab, and actually I try to inspect the form I
do. See now. There are different text
Fields as shown incredible. And
that's an additional hidden field which is actually generating a
PHP session value.
So now let's take a look what happens if you submit the phone.
You do see that the form was submitted with the 200 response.
So we just click on the file itself. We can see what
has been submitted.
So, we have been successfully been able to submit all
the values along with the nitin field, which is actually maintaining this
session.
This particular scenario is quite similar to what we saw in
the previous scene where the session ID was being passed for
the URL.
You can be used for same, multiple parallel sessions where
each and every request has to be sent over
the form itself. And since it is generated over
the form itself. There's no need for cookie. So, wherever
an end user is using an unsupported browser.
This is something, can we use to in order
to maintain such and persistence?
We do have a similar topic as to the
last scenario where if the particular browser is being
closed. The session would be terminated and the
user again would be to re-authenticate and open up a
new session.
I wanted to talk back. Is that each? And
every request has to be sent via, post method won't lie.
So what does that mean? We cannot have any hyperlinks at
the same time. We cannot secure any of those resources such as
images or videos, because everything has
to be sent via post body.
No, nothing could notice is that this particular method?
Is to be very hardly seen in today's modern web development. Is
something that was being used way back when
the WWE actually started whether web
development was me.
Just kind of a. Somebody got this section cookies
actually use in order to maintain persistence or
a long time.
In case, if those are not secured properly, there are
certain attacks that can be used in order to steal those groupies itself
and others mechanism, such as
passing the session over the URL. Or
over an intercom. Something can be used
whenever a browser or the client will
not support use of cookies, but these are
actually susceptible to Common attacks.
That is why this video. Thank you.