COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-31

Accessing/Intercepting/Modifying HTTP Cookies

This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Obtain copy of cookie

The adversary first needs to obtain a copy of the cookie. The adversary may be a legitimate end user wanting to escalate privilege, or could be somebody sniffing on a network to get a copy of HTTP cookies.

Kullanılan teknikler

  • Sniff cookie using a network sniffer such as Wireshark
  • Obtain cookie using a utility such as the Firefox Cookie Manager, Chrome DevTools or AnEC Cookie Editor.
  • Steal cookie via a cross-site scripting attack.
  • Guess cookie contents if it contains predictable information.
2

Experiment

Obtain sensitive information from cookie

The adversary may be able to get sensitive information from the cookie. The web application developers may have assumed that cookies are not accessible by end users, and thus, may have put potentially sensitive information in them.

Kullanılan teknikler

  • If cookie shows any signs of being encoded using a standard scheme such as base64, decode it.
  • Analyze the cookie's contents to determine whether it contains any sensitive information.

Modify cookie to subvert security controls.

The adversary may be able to modify or replace cookies to bypass security controls in the application.

Kullanılan teknikler

  • Modify logical parts of cookie and send it back to server to observe the effects.
  • Modify numeric parts of cookie arithmetically and send it back to server to observe the effects.
  • Modify cookie bitwise and send it back to server to observe the effects.
  • Replace cookie with an older legitimate cookie and send it back to server to observe the effects. This technique would be helpful in cases where the cookie contains a "points balance" for a given user where the points have some value. The user may spend their points and then replace their cookie with an older one to restore their balance.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Target server software must be a HTTP daemon that relies on cookies.
  • The cookies must contain sensitive information.
  • The adversary must be able to make HTTP requests to the server, and the cookie must be contained in the reply.

Gerekli beceri

  • Low: To overwrite session cookie data, and submit targeted attacks via HTTP
  • High: Exploiting a remote buffer overflow generated by attack

Gerekli kaynak

  • A utility that allows for the viewing and modification of cookies. Many modern web browsers support this behavior.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Modify Data

Etkilenen alanlar: Integrity

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Design: Use input validation for cookies
2
Design: Generate and validate MAC for cookies
3
Implementation: Use SSL/TLS to protect cookie in transit
4
Implementation: Ensure the web server implements all relevant security patches, many exploitable buffer overflows are fixed in patches issued for the software.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
There are two main attack vectors for exploiting poorly protected session variables like cookies. One is the local machine itself which can be exploited directly at the physical level or indirectly through XSS and phishing. In addition, the adversary in the middle attack ( CAPEC-94 ) relies on a network sniffer, proxy, or other intermediary to intercept the subject's credentials and use them to impersonate the digital subject on the host. The issue is that once the credentials are intercepted, impersonation is trivial for the adversary to accomplish if no other protection mechanisms are in place. See also: CVE-2010-5148 , CVE-2016-0353
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies — DayBreach Saldırı Sözlüğü · DayBreach