Session management testing.
As I mentioned before, HDP is a state less protocol.
So does that mean exactly it just means that at least two consecutive requests to the same domain are
not associated by the Web server?
So Web servers cannot bind these requests and perform user based tasks to accomplish this, Web server
set cookies to the related HTTP responses by adding the set cookie header.
And here, cookies can store a unique session information for each user to interact with the application
so the application can differentiate between users based on these unique session identifiers.
So that's why session management is one of the core components of a Web application.
And we strongly need it, it's essential it helps to control, maintain and follow the state of the
users or any other entity that interacts with the application.
So session management broadly covers anything from how the user authentication is performed all the
way to what happens to them until they log out.
So in this section, we're going to examine cookies in great detail and then cover some of the necessary
session controls.
Then we're going to continue with two very popular session management vulnerabilities, session fixation
and cross site request forgery.
OK, so let's dive right in.
Now, you, of course, know what cookies are and what they're used for.
I don't want to, you know, add something else to the definition.
So when a Web server sets a cookie with a set cookie header, it can also add some other parameters
to that header.
And we can assume that they are part of the configuration and security parameters of the cookie, right?
So with these parameters, a Web server can define the cookie policy of the application.
So each of these cookie attributes can impact the application security.
Makes sense.
So the next couple of lessons, we're going to cover cookie attributes, so open carry and log in to
be Web.
And enable Foxe proxy.
Then open HDB only cookies from the drop down menu, and when you click on the hack button, Berp will
get the first request.
And that's what we're looking at here.
So let's forward it and it will redirect us to the associated page, so forward it again.
And then the browser automatically requests the redirected page forwarded.
OK, so this is the response that I want to capture.
Hear the allegations set and other kookie top security with the value No.
And also, there are some other parameters for that cookie it.
It has expired and HARTH parameters so expires tells the browser the point in time when the cookies
not valid.
This parameter causes the browser to store the cookie into persistent storage until the specified date
value that was set.
It is used to define the persistent cookies and it is reused in subsequent browser sessions until the
expiration date is reached.
So if this attribute is not set, the cookie is used only in the current browser session.
And a path tells the browser for which path is cookie is valid.
So the path parameters used for locking down the cookie to a particular path on the server.
If the domain specified is Abdul-Karim and the path is set to mail, the cookie would only be sent to
the pages inside Abdulkarim Mail.
OK.
And top security is valid for all the applications directorate.
OK, so forward it.
Disable interception and go to the browser.
Now the developer prepares a simple page to watch how cookies behave.
So quick, the cookies button to see your current cookies.
All right, so we have three cookies with these values.
And if you click here, the JavaScript alert code will execute and show the cookies.
So what we're looking at here is three of the cookies are shown in the alert message.
Now enable berp interception.
OK, let's change the level to medium.
And forward the request.
And the levels changed, so I'm going to forward until I see, you know, Cookie, OK?
And there is a new cookie here.
It's the same name, but with a value maybe.
Expire and path parameters are still present and there is one more parameter HTP only.
So this parameter is set to mitigate the risk posed by cross site scripting attacks, since it does
not allow the cookie to be accessed via a client side script such as JavaScript.
So if this attribute is set, the cookie cannot be directly accessed via clients by JavaScript, right?
All right, so forward the response and go to the page.
Now click to see cookies, so we have three cookies again.
All right, so glad to have you with JavaScript.
And you see the top security cookie is not the message now.
Because JavaScript cannot reach HDP only cookies.
So this is true, there is no exploit in the browser and the server software.
Now, there's not a significant difference if you go to high level.
So I'm just going to view the code, go to terminal, opened up this page.
Scroll down a little bit.
All right, so here's the code.
The set cookie function defines the cookie with its attributes and weight as parameter, and the argument
specifies HDTV only and is set for medium and high level.
In case you were doubting me earlier, but the high level is different only because of the expiration
value.
All right, so let's let's now look at another important parameter.