Skip to main content

Web Application Hacking : Cookie Stealing

Cookie Stealing

                                 Cookies are small datas (usually 4KB in size) that are stored in clients browser . They are usually generated at the server by the server side scripting language . After that they are sent back and stored at the client browser.They help in tracking necessary information like the time of access,username,session information,etc of the client who is logged into a particular website  

                                 In this tutorial I am going to show how cookies are being stolen and logged into a separate file.


                                                                      CAUTION
"This tutorial should be used for educational purpose only. I won't be responsible if you misuse this techniques and get yourself in trouble.Performing such attacks without the permission of the owner can lead to serious trouble."


                                Here is the HTML code of the login form of a sample application.



Now I need to write a server side scripting language to generate cookies to store username and password for a particular user in the browser .


The above piece of code is written in PHP and it does two work

  • It generates cookies
  • It includes a file containing the comments of the users.
                           Now I need one more thing i.e a cookie stealing script.
Download here :https://github.com/dibsy/codesec/blob/master/cookieStealer.php 

Now I am going to place the cookie stealing script and the log file at a remote server or may upload to a hosting website.

Now say suppose there is a forum which allows users to post their comments.Say for examples some thing like this
Now I am going to inject some codes here. I am going to redirect the cookies to a cookie stealing script in this way.



Now my script is ready to accept and log any sort of cookies that are stored in the browser  of any client whoever is trying to access the comment section.

Now say someone logs into his/her account

username=admin
password=password


And now if I check the log file of the cookies where the cookies are stored then I can find my cookies logged



------------------------------------ Thanks for reading----------------------------------


Popular posts from this blog

KringleCon : Sans Holiday Hack 2018 Writeup

SANS HOLIDAY HACK 2018 Writeup , KRINGLECON The objectives  Orientation Challenge  Directory Browsing  de Bruijn Sequences  Data Repo Analysis  AD Privilege Discovery  Badge Manipulation  HR Incident Response  Network Traffic Forensics  Ransomware Recovery  Who Is Behind It All? First I go to Bushy Evergreen and try to solve the terminal challenge . Solving it is fairly easy , Escape_Key followed by  ":q" without quotes After this we move to the kiosk and solve the questions The question were based on the themes of previous Holiday Hack Challenges. Once we answer it correctly we get the flag. For this I visited Minty Candycane and I tried to solve the terminal challenge.  The application has command injection vulnerability , so injecting a system command with the server ip allows execution of the command. So first I perform an `ls` operation to list of the directory contents , followed by a cat of t

Linux Privilege Escalation : SUID Binaries

After my OSCP Lab days are over I decided to do a little research and learn more on Privilege Escalation as it is my weak area.So over some series of blog post I am going to share with you some information of what I have learnt so far. The methods mentioned over here are not my own. This is something what I have learnt by reading articles, blogs and solving CTFs SUID - Set User ID The binaries which has suid enabled, runs with elevated privileges. Suppose you are logged in as non root user, but this suid bit enabled binaries can run with root privileges. How does a SUID Bit enable binary looks like ? -r- s r-x---  1 hack-me-bak-cracked hack-me-bak         7160 Aug 11  2015 bak How to find all the SUID enabled binaries ? hack-me-bak2@challenge02:~$ find / -perm -u=s 2>/dev/null /bin/su /bin/fusermount /bin/umount /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/bin/gpasswd /usr/bin/newgrp /usr/bin

Bluetooth Low Energy : Build, Recon,Enumerate and Attack !

Introduction In this post I will try to share some information on bluetooth low energy protocol. Bluetooth Low Energy ( BLE ) is Bluetooth 4.0.It has been widely used in creating "smart" devices like bulbs that can be controlled by mobile apps, or electrical switches that can be controlled by mobile apps. The terms Low Energy refers to multiple distinctive features that is operating on low power and lower data transfer. Code BLE Internals and Working The next thing what we need to know is a profile. Now every bluetooth device can be categorized based on certain specification which makes it easy. Here we will take a close look into two profiles of Bluetooth which is specifically designed for BLE. Generic Access Profile (GAP) - This profiles describes how two BLE devices defines discovery and establishment of connection with each other. There are two types of data payload that can be used. The Advertising Data Payload and Scan Response Payload . The GAP uses br