In this picture, we're going to learn how to bypass other authentication by manipulating cookie values.
Now, this doesn't always happen and it's not always possible, but it's possible when the session management
is programmed in a way that can easily be bypassed.
And I'll talk more about that once we actually do the attack.
But before we do anything, we need to have a plug in that allow us to modify our cookies.
So the first thing that I'm going to do is go on Google.
And look for kooky ed.
Firefox's.
And I'm going to download kookie manager plus, all they have to do is just click on the link to Firefox
and install.
And it's going to ask you to restart, so I'm going to restart it.
And it should be installed now.
Now.
The cookies are used to authenticate users after they log in, so, for example, once you go in here
and log in.
I've already created an account on this, you can create one by just clicking on the register here and
the account that I created, the username Zayde.
And the password is one, two, three, four, five, six.
Now, once I log in here, you'll notice that every time I go to a different page, I don't have to
log in again.
So every time I just browse through this website, you'll see that I don't get presented to log in again.
And everywhere I go, it knows that I'm logged in.
Azad.
Now, this is possible based on cookies.
So every time I go to this website or to these pages, they know that they is trying to get in here
because the cookies are stored in my browser.
And every time I request something from this website, the cookies are sent to that Web page and it's
telling that it has already authenticated himself.
And he is just trying to display this website.
So even if I close this, so I'm just going to close Mattilda and just get back to it again.
You'll see that I'm still logged in, Azad, no cookies have a date of expiry and they'll expire after
a while.
Sometimes the cookies are configured in a way that they can be easily manipulated.
So let's have a look on the cookies for this website.
Now, if we go, I'm going to click on AWALT to display the menus here, and then I'm going to go on
Tool's cookie manager plus and I'm going to search for the name of this website, which is 10 2014 to
12.
And that'll display all the cookies that have been sent.
So you can see that the upside and all these cookies.
You can see that there's two interesting cookies, one of them is called username and the other one
is called User ID or UID.
So this is really interesting and if we click on edit.
You'll see that we have the name of the cookie is Eweida or user idea, and the content is 17.
So you can try to guess that means that this cookie is telling this page that the user ID of the person
who's trying to visit this page is 17.
So we can guess that the user idea for Z for the user that I just created is 17.
So what we can do is we can try to modify this to a different value and see what happens, and often
admin users are created first ad at every website so we can try to go for one.
So I'm just going to delete the seven and I'm going to keep it as one, and then we're going to save
the cookies like this.
I'm going to close that.
And then I'm just going to refresh the page.
I know you can see that I actually I'm logged in as admin and I can browse the website and do anything
that the admin is allowed to do.
And we managed to do this very simply by modifying our cookies and changing our user I.D. to user I.D.
number one.
So this was possible because the cookies that are used are very simple now, cookies should be more
complicated, so they should actually use what's known as session IDs or tokens.
These tokens should be very complicated and not relate to the user ID.
That way, I wouldn't be able to know what the user ID.
Even if I know that the admin has a user idea of one, I wouldn't be able to know what token that admin
is using.
So they should be dynamically generated based on each user and they should vary from time to time.
So even for the same user, every time he logs in, they should get different tokin randomly based on
some parameters so that it's very difficult for anybody to know what tokin each user gets.
Otherwise, it will be very easily for people to guess what in the admiral or any other user has and
just injected into their browser.
Now, using complicated tokens and session ideas is still vulnerable for money in the middle attacks.
And we see that in plugins like Firesheep and in programs like Ferrett and Hampster, where I actually
explained that in my network penetration testing course, where you could gain access to any user account
as long as the people are on the same network as you.
So even if the token is really complicated, you'll be able to capture that token and then inject it
into the browser.
But the main idea is the website is not vulnerable because you can't guess it yourself.
You have to actually capture that token from another person and then inject it.
Whereas in here we were able to just know or guess that the admin has an idea of one, inject it and
then log in as admin.