41. Session Hijacking – Tokens, Cookies and Defence
41.4 XSS Path to Session Cookies – Defence First
XSS (Cross-Site Scripting) = attacker script runs in victim's browser in your origin. If session cookie is not HttpOnly, script can often read it and send it out. Even with HttpOnly, XSS can still act as the user (drive UI, CSRF-like actions) – so XSS fix is still mandatory.
High-level Blue (OWASP themes – no exploit kit here):
- Output encoding / context-aware escaping
- CSP (Content-Security-Policy) to limit script sources
- HttpOnly on session cookies
- Avoid
innerHTMLwith raw user input; sanitize where needed - WAF as belt; code fix as suspenders
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Injects script into reflected/stored field on OWN lab app | Encode output; CSP; input validation |
Reads document.cookie when HttpOnly missing |
HttpOnly session cookie; short TTL |
| Uses XSS to call APIs as victim without stealing cookie | CSP + SameSite + CSRF tokens + least privilege |
Ravindra Bagale's Tip
Students say "HttpOnly = XSS is dead". HttpOnly reduces cookie theft – but XSS can still abuse the account. Fix the XSS + cookie flags + CSP. If this isn't clear, read it again.
Ravindra Bagale's Tip – मराठी
Students "HttpOnly = XSS संपला" म्हणतात. HttpOnly cookie चोरी कमी करते – XSS अजूनही account abuse करू शकते. Fix XSS + cookie flags + CSP. समजले नसेल तर पुन्हा वाचा.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "HttpOnly = XSS खत्म". HttpOnly cookie चोरी कम करता है – XSS फिर भी account abuse कर सकता है. Fix XSS + cookie flags + CSP. समझ न आया हो तो फिर से पढ़ो.
Lab
OWN DVWA / Juice Shop / tiny PHP reflection page on host-only only. Show (trainer path) how a reflected field echoes script; note cookie visibility in DevTools with/without HttpOnly. Do not point at internet sites. Write 8-line fix note: encode, CSP header, HttpOnly, SameSite.
Real incident: British Airways Magecart-style skimming (2018)
In 2018, British Airways reported a supply-chain / malicious JavaScript injection on payment-related pages (Magecart-class public reporting) that harvested customer payment and personal data as users checked out. The UK ICO later issued a large fine under GDPR (widely reported; amounts and final figures – verify official ICO notices). Lesson for session/payment pages: third-party / injected JS on sensitive flows can steal secrets and session-adjacent data; CSP, subresource integrity, tight change control, and monitoring of payment page scripts matter. Source: BA / ICO public statements and major news coverage of the 2018 incident (verify; say "reported").