Secure those cookies
OWASP lists “Broken Authentication and Session Management” as the second most exploited vulnerability, and suggest testing your application for weak session management. The session management implementation is the process of tracking the user’s activity in the form of cookies across the users’ interaction with the system/ web application.
Session and Cookie Management
While developing an application with secure session management, cookie management plays a vital role which would require understanding of cookies details like attributes (Secure Flag, Connection type, Session expiration time, etc.), Unique values (session ID) and to under-stand how the attackers exploit the weak session management vulnerabilities.
- Session Hijacking: A malicious user acquires a valid session identifier after it has been assigned to an individual and inherits that individual’s permissions
- Session Fixation: Attacker fixing the session even before the legitimate user accesses the application and thus tracks all the things the user is accessing
- Session Predication: Technique / Attack where attacker has possibility of hijacking the session of a legitimate user in order to gain the access of User2 (user).Cookie Poisoning / Tampering: Cookie poisoning is the modification of a cookie by an attacker to gain unauthorized information about the user
- Session Sniffing: The attacker uses a sniffer to capture a valid token session and then he uses the valid token session to gain unauthorized access to the web server
Market / Business Impacts
- Privilege escalation – Unauthorized access to Web site functionality
- Circumvent licensing and payments
- Confidentiality breach