‫All right, so another important cookie attribute is the secure attribute.
‫It tells the browser not to send the cookie over the connection unless it's HDB.
‫So let's have a look at.
‫On also open web developer, we're going to need that to.
‫And then from the menu, choose secure cookies.
‫And go to berp.
‫And forward these requests.
‫And here is the important response, we have the top security cookie again with the value no, so forward
‫it.
‫Go back to the browser.
‫Click the request.
‫And cookies.
‫And looky here, what do we have for the top security cookie?
‫It's defined as HTP only and has the expire and path attributes, but no secure directive.
‫OK, change back to medium, go to berp.
‫Now, this is the request sent to the server.
‫As you can see, the only top security cookie goes with a request.
‫And it is an HTP request.
‫So I'll forward that a few times.
‫Now, this time, we have this Akua attribute for the cookie, so forward it and go to the browser.
‫Cook this one.
‫And here are the cookie properties.
‫So I think this is a very nice view.
‫And the secure parameter is set by the server.
‫OK, so now I'm going to open another page.
‫Nothing happens because burp intercepts, let's look at the request.
‫It doesn't contain the top security with the may be value.
‫So because it is a secure cookie and the browser automatically prevents it from sending over a non SSL
‫channel.
‫OK, so let them go.
‫And if you can change it.
‫Hi.
‫Yeah, I think it's going to exchange except for the expired value.
‫So let's have a look at the code.
‫Scroll down.
‫And here is a code, so the sixth argument said.
‫Is a secure attribute for a cookie.
‫And the medium and high levels are only set.
‫OK, so we have examined four attributes of cookies, so it's possible to see some other ones out in
‫the real world.
‫So I do want to add one more.
‫The domain attributes.
‫So it specifies the domain to which the cookie would be sent.
‫Makes sense, the domain value must be the same or a subdomain of the domain from which the cookie is
‫received.
‫So this attribute matches, then the path attribute will be checked next.
‫All right.
‫So it's all about the cookies, baby.
‫So in a penetration test, you should definitely report the cookies that are not HDB only and secure.
‫Especially if they are selling cookies.