Cookie Tampering

DECODING AND ENCODING

Many times, cookies are encoded using base32 or base64 to convert binary data into human-readable characters. If a cookie is encoded it may look like a string of random letters and numbers, instead of readable values.

Encoding, unlike hashing, isn't a security function. This means that you can easily decode and encode values using online tools that can encode and decode base32 and base64 values to decode an encoded cookie into something that can be read and modified.

You can also use those same tools to encode the modified cookie values back to an encoded string before sending the tampered request.

SESSION FIXATION

Unlike session hijacking, session fixation is a type of attack that allows an attacker to establish a session on the victim's computer before the user accesses a website using sensitive information. This session ID can then be accessed by the attacker to see the victim's information.

There are several ways that a session fixation attack can be executed.

• URL Argument

One common way is that an attacker gets a cookie from the target web app and then sends that session ID via a link to the victim so that the victim logs in with the attacker's cookie. The victim then could provide their login credentials or other sensitive information that will be saved in that session. Since the attacker was the one who sent the cookie, they already know the session ID and can access the user's account and see any information that was saved when the victim signed in using the previously established session.

• Client-side scripting

The attacker could use code injection in an XSS attack to insert code in the hyperlink sent to the victim. This code could fix a session ID in its cookie.

• Packet interception

If an attacker is able to establish a connection in the middle of the client's browser and the web server, they would be able to intercept the HTTP headers and manipulate the server response by inserting the Set-Cookie parameter and thus fixing whatever session ID the attacker wants between the victim's browser and the webserver.

OWASP has a comprehensive guide on session fixation here.

COOKIE MANIPULATION

Sometimes certain parameters such as whether a user's session should be given admin privileges can be visible in cookies and if the web app is not set up securely, it could be possible for an attacker to modify cookies they send and even override other considerations that could give precedent to the cookies' value.