41. Session Hijacking – Tokens, Cookies and Defence
41.2 Cookie Theft and Insecure Transit
Cookie flags defenders must recite in sleep:
| Flag | Idea |
|---|---|
| Secure | Cookie only on HTTPS – not plain HTTP |
| HttpOnly | JavaScript cannot read document.cookie for that cookie – XSS steal harder |
| SameSite (Strict / Lax / None) | Cross-site send rules – CSRF risk shrinks with Strict/Lax |
Sidejacking era lesson: user logs in over HTTPS, then later hits HTTP pages on same site / same Wi-Fi – session cookie rides cleartext → sniffer copies it. Fix push: HTTPS everywhere + Secure flag + HSTS.
# Concepts – inspect Set-Cookie on YOUR lab only (example)
curl -sI http://192.168.56.40/login.php | tr -d '\r' | grep -i set-cookie
# After you enable HTTPS on lab (self-signed OK):
# curl -skI https://192.168.56.40/login.php | tr -d '\r' | grep -i set-cookie
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Sniffs HTTP Set-Cookie / Cookie on open Wi-Fi (classic sidejack) | Force HTTPS; Secure flag; HSTS; no mixed content |
| Reads cookie via XSS if not HttpOnly | HttpOnly; CSP; output encoding |
| Replays stolen Cookie header with curl/Burp | Short TTL; regenerate; anomaly detection |
Ravindra Bagale's Tip
Students set HttpOnly but skip the Secure flag – the cookie still leaks in transit. Use both (Secure + HttpOnly) + a sensible SameSite. Interview: name the three flags with one line each. Keep this in mind.
Ravindra Bagale's Tip – मराठी
Students Secure flag सोडून HttpOnly लावतात – transit मध्ये अजून leak. दोन्ही (Secure + HttpOnly) + योग्य SameSite. Interview: तिन्ही flags ची नावे एक-एक line सह सांगा. लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students Secure flag छोड़कर HttpOnly लगा देते हैं – transit में फिर भी leak. दोनों (Secure + HttpOnly) + सही SameSite. Interview: तीनों flags के नाम एक-एक line के साथ बताओ. ध्यान रखो.
Lab
On OWN lab PHP site at 192.168.56.40: login, capture Set-Cookie with curl/browser DevTools. Note missing flags. Enable HTTPS (self-signed OK in lab), set session.cookie_secure=1, session.cookie_httponly=1, SameSite=Lax. Re-capture. Document before/after for Rani.
Real incident: Firesheep / sidejacking (2010)
In 2010, security researcher Eric Butler released Firesheep, a Firefox extension demo that showed how easy it was to capture HTTP session cookies on open Wi-Fi and impersonate users of major sites that still served much traffic in cleartext. Public reporting and the ensuing industry push accelerated HTTPS-by-default and Secure cookie adoption. Weakness: session cookies over HTTP on shared networks. Defence: HTTPS everywhere, Secure + HttpOnly cookies, HSTS. Source: contemporary coverage of Firesheep / Eric Butler demo and HTTPS adoption retrospectives (verify; say "reported" for impact anecdotes).