No, cookie attacks doesn’t refer to Attack of the Killer Cookies. Instead, cookie attacks refers to attacks related to cookies.
Can you recognize a cookie? Do you know what type of attacks allow an attacker to access cookies? For example, can you answer this sample Security+ practice test question recently added to the gcgapremium.com online test banks?
Q. A penetration tester has successfully exploited a vulnerability against your organization giving him access to the following data:
User, password, login-date, cookie-id
Homer, canipass, 2016-09-01 11:12, 286755fad04869ca523320acce0dc6a4
Bart, passican, 2016-09-01 11:15, 8edd7261c353c87a113269cd37635c68
Marge, icanpass, 2016-09-01 11:19, 26887fbd90ac0340e29ad62470270401
What type of attack does this represent?
A. SQL injection
B. XML injection
C. XSS
D. Session hijacking
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Cross-Site Scripting
Cross-site scripting (XSS) is a web application vulnerability that can be prevented with input validation. Attackers embed malicious HTML or JavaScript code into an email or web site error message. If a user responds to the email or error message, it executes the code. Many times, this gives the attacker access to user cookies or other information about the user.
Note. Cookies are simply text files stored on a user’s system. The text can be anything desired by the website (or the website developers).
You may be wondering why the acronym isn’t CSS instead of XSS. The reason is that web sites use Cascading Style Sheets (identified as CSS) and CSS files are not malicious.
HTML and JavaScript code use tags surrounded by the < and > characters. For example, images are placed within a web page with the <img> tag. These tags support many additional options and commands, which developers use to create feature-rich web pages. However, attackers can manipulate these tags to run malicious code. Attackers often embed cross-scripting code into comments on blog pages or forums when the page allows users to include HTML tags.
As an example, a bug in Twitter’s web site resulted in a cross-site scripting problem in 2010. A malicious Twitter user discovered the bug and embedded JavaScript code into a tweet. When innocent users opened a web page that included the malicious tweet, the code ran on their systems. In this case, the malicious code used the onMouseOver event. When users hovered their mouse over the tweet, it did two things. It retweeted the tweet, sending it out to all of the user’s followers. It also launched a pop-up window displaying content from a hard-core Japanese pornography web site.
Although this attack was more embarrassing to Twitter than harmful to end users, many other cross-site scripting attacks are malicious. They can allow attackers to redirect users to other web sites, steal cookies off a user’s system, read passwords from a web browser’s cache, and more. If a web site stored private data in a user’s cookie, such as a username and password, an attacker can use a cross-site scripting attack to retrieve this information.
The primary protection against cross-site scripting attacks is at the web application with input validation techniques to block the use of HTML tags and JavaScript tags. Tags are embedded within the < and > characters, so it’s possible to block these tags by rejecting any text that includes these characters. It’s also important to educate users about the dangers of clicking links. Some XSS attacks send emails with malicious links within them. The XSS attack fails if users do not click the link.
Remember this
Cross-site scripting (XSS) attacks allow attackers to capture user information such as cookies. Input validation techniques at the server help prevent XSS attacks.
Session Hijacking Attacks
When a user logs on to a web site, the web site often returns a cookie with a session ID. In many cases, this cookie is stored on the user’s system and remains active until the user logs off. If the user closes the session and returns to the web site, the web site reads the cookie and automatically logs the user on. This is convenient for the user, but can be exploited by an attacker.
In a session hijacking attack, the attacker learns the user’s session ID and uses it to impersonate the user. The web server doesn’t know the difference between the original user and the attacker because it is only identifying the user based on the session ID.
Attackers can read cookies installed on systems through several methods, including cross-site scripting attacks and Flash cookies (described in the next section). Once they have the session ID, they can use header manipulation to hijack the session.
Q. A penetration tester has successfully exploited a vulnerability against your organization giving him access to the following data:
User, password, login-date, cookie-id
Homer, canipass, 2016-09-01 11:12, 286755fad04869ca523320acce0dc6a4
Bart, passican, 2016-09-01 11:15, 8edd7261c353c87a113269cd37635c68
Marge, icanpass, 2016-09-01 11:19, 26887fbd90ac0340e29ad62470270401
What type of attack does this represent?
A. SQL injection
B. XML injection
C. XSS
D. Session hijacking
Answer: C. Cross-site scripting (XSS) is the best choice of the available answers. You can see that the penetration tester is looking at cookies because the header includes ‘cookie-id’ and successful cross-site scripting (XSS) attacks allow attackers to capture user information such as cookies.
Note that it is poor programming practice to store user passwords within a cookie. However, poor programming practices probably led to the vulnerability allowing the pen tester to exploit an XSS vulnerability.
A SQL injection attack uses a SQL statement, and typically includes a phrase such as or 1=1.
An XML injection attack would include XML markup data, with XML tags within the < and > symbols.
A session hijacking attack uses a cookie to take over a session. However, it’s more than just the text within a cookie.
See Chapter 6 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide for more information on attacks, including cross-site scripting attacks.
