All right, so another important cookie attribute is the secure attribute.
It tells the browser not to send the cookie over the connection unless it's HDB.
So let's have a look at.
On also open web developer, we're going to need that to.
And then from the menu, choose secure cookies.
And go to berp.
And forward these requests.
And here is the important response, we have the top security cookie again with the value no, so forward
it.
Go back to the browser.
Click the request.
And cookies.
And looky here, what do we have for the top security cookie?
It's defined as HTP only and has the expire and path attributes, but no secure directive.
OK, change back to medium, go to berp.
Now, this is the request sent to the server.
As you can see, the only top security cookie goes with a request.
And it is an HTP request.
So I'll forward that a few times.
Now, this time, we have this Akua attribute for the cookie, so forward it and go to the browser.
Cook this one.
And here are the cookie properties.
So I think this is a very nice view.
And the secure parameter is set by the server.
OK, so now I'm going to open another page.
Nothing happens because burp intercepts, let's look at the request.
It doesn't contain the top security with the may be value.
So because it is a secure cookie and the browser automatically prevents it from sending over a non SSL
channel.
OK, so let them go.
And if you can change it.
Hi.
Yeah, I think it's going to exchange except for the expired value.
So let's have a look at the code.
Scroll down.
And here is a code, so the sixth argument said.
Is a secure attribute for a cookie.
And the medium and high levels are only set.
OK, so we have examined four attributes of cookies, so it's possible to see some other ones out in
the real world.
So I do want to add one more.
The domain attributes.
So it specifies the domain to which the cookie would be sent.
Makes sense, the domain value must be the same or a subdomain of the domain from which the cookie is
received.
So this attribute matches, then the path attribute will be checked next.
All right.
So it's all about the cookies, baby.
So in a penetration test, you should definitely report the cookies that are not HDB only and secure.
Especially if they are selling cookies.