‫Session management testing.
‫As I mentioned before, HDP is a state less protocol.
‫So does that mean exactly it just means that at least two consecutive requests to the same domain are
‫not associated by the Web server?
‫So Web servers cannot bind these requests and perform user based tasks to accomplish this, Web server
‫set cookies to the related HTTP responses by adding the set cookie header.
‫And here, cookies can store a unique session information for each user to interact with the application
‫so the application can differentiate between users based on these unique session identifiers.
‫So that's why session management is one of the core components of a Web application.
‫And we strongly need it.
‫It's essential it helps to control, maintain and follow the state of the users or any other entity
‫that interacts with the application.
‫So session management broadly covers anything from how the user authentication is performed all the
‫way to what happens to them until they log out.
‫So in this section we are going to examine cookies in great detail and then cover some of the necessary
‫session controls.
‫Then we're going to continue with two very popular session management vulnerabilities, session fixation
‫and cross site request forgery.
‫OK, so let's dive right in now.
‫You, of course, know what cookies are and what they're used for.
‫I don't want to, you know, add something else to the definition.
‫So when a Web server sets a cookie with a set cookie header, it can also add some other parameters
‫to that header.
‫And we can assume that they are part of their configuration and security parameters of the cookie,
‫right.
‫So with these parameters, a Web server can define the cookie policy of the application.
‫So each of these cookie attributes can impact the application security.
‫Makes sense.
‫So the next couple of lessons, we're going to cover cookie attributes.
‫So open Kelley and logging to be web and enable Foxe proxy.
‫Then open HDB only cookies from the drop down menu, now when you click on the hack button, Berp will
‫get the first request and that's what we're looking at here.
‫So let's forward it and it will redirect us to the associated page, so forward it again.
‫And then the browser automatically requests the redirected page forwarded.
‫OK, so this is the response that I want to capture.
‫Here, the application set another cookie, top security with a value no.
‫And also, there are some other parameters for that cookie it.
‫It has expired and HARTH parameters so expires tells the browser the point in time when the cookies
‫not valid.
‫This parameter causes the browser to store the cookie into persistent storage until the specified date
‫value that was set.
‫It is used to define the persistent cookies and it is reused in subsequent browser sessions until the
‫expiration date is reached.
‫So if this attribute is not set, the cookie is used only in the current browser session.
‫And a path tells the browser for which path is cookie is valid.
‫So the path parameters used for locking down the cookie to a particular path on the server.
‫If the domain specified is apt dotcom and the path is set to mail, the cookie would only be sent to
‫the pages inside app dotcom SGML.
‫OK.
‫And top security is valid for all the applications directorate.
‫OK, so forward it.
‫Disable interception and go to the browser.
‫Now the developer prepares a simple page to watch how cookies behave.
‫So click the cookies button to see your current cookies.
‫All right, so we have three cookies with these values.
‫And if you click here, the JavaScript alert code will execute and show the cookies.
‫So what we're looking at here is three of the cookies are shown in the alert message.
‫Now enable berp interception.
‫OK, let's change the level to medium.
‫And forward their request.
‫And the levels changed, so I'm going to forward until I see, you know, Cookie, OK, and there is
‫a new cookie here.
‫It's the same name, but with a value maybe.
‫Expire and path parameters are still present and there is one more parameter HTP only.
‫So this parameter is set to mitigate the risk posed by cross site scripting attacks, since it does
‫not allow the cookie to be accessed via a client side script such as JavaScript.
‫So if this attribute is set, the cookie cannot be directly accessed via client side JavaScript, right?
‫All right, so forward the response and go to the page.
‫Now click to see cookies, so we have three cookies again.
‫All right, so quick to have you with JavaScript.
‫And you see the top security cookie is not the message now.
‫Because JavaScript cannot reach HDP only cookies.
‫So this is true, there is no exploit in the browser and the server software.
‫Now, there's not a significant difference if you go to high level.
‫So I'm just going to view the code, go to terminal, opened up this page.
‫Scroll down a little bit.
‫All right, so here's the code.
‫The set cookie function defines the cookie with its attributes and weight is parameter, and the argument
‫specifies HDTV only and is set for medium and high level.
‫In case you're doubting me earlier, but the high level is different only because of the expiration
‫value.
‫All right, so let's let's now look at another important parameter.