In this lecture we're going to learn how to bypass other authentication by manipulating cookie values.
Now this doesn't always happen and it's not always possible but it's possible when the session management
is programmed in a way that can easily be bypassed.
And I'll talk more about that once we actually do the attack.
But before we do anything we need to have a plugin that allow us to modify our cookies.
So the first thing that I'm going to do is go on google and look for Kuki editor
Firefox and I'm going to download cookie Manager Plus all they have to do is just click on the link
to Firefox and install and it's going to ask you to restart.
So I'm going to restart it.
And it should be installed now.
Now the cookies are used to authenticate users after they log in.
So for example once you go in here and log in I've already created an account on this.
You can create one by just clicking on the register here and they can that I created the username zayd
and the password is 1 2 3 4 5 6.
Now once I log in here you'll notice that every time I go to a different page I don't have to log in
again so every time I just browse through this Web site you'll see that I don't get presented to log
in again and everywhere I go it knows that I'm logged in as zayd.
Now this is possible based on cookies.
So every time I go to this website or to these pages they know that Zayd is trying to get in here because
the cookies are stored in my browser.
And every time I request something from this website the cookies are sent to that web page and still
an ad that Zayd has already authenticated himself and he is just trying to display this Web site.
So even if I close this so I'm just going to close all day and just get back to it again.
You'll see that I'm still logged in as Zahed no cookies have a date of expiry and they'll expire after
a while.
Sometimes the cookies are configured in a way that they can be easily manipulated.
So let's have a look on the cookies for this website.
Now if we go I'm going to click on Allt to display the menus here and I'm going to go on tools.
Cookie manager applause and I'm going to search for the name of the website which is 10:22 11:46 and
that will display all the cookies that have been sent.
So you can see that the PH VSS ID and all these cookies you can see that there's two interesting cookies
one of them is called username and the other one is called user ID or you I.D..
So this is really interesting and if we click on edit you'll see that we have the name with the cookie
is you I.D. or user ID and the content is 17.
So you can try to guess that means that this cookie is telling this page that the user id of the person
who is trying to visit this page is 17.
So we can guess that the user id for Zayde for the user that I just created is 17.
So what we can do is we can try to modify this to a different value and see what happens.
And often as many users are created first at every Web site so we can try to go for one.
So I'm just going to delete the seven and I'm going to keep it as one.
And then we're going to save the cookies like this.
I'm going to close that and then I'm just going to refresh the page.
Now you can see that I've actually logged in as admin and I can browse the web site and do anything
that the Adnan's are allowed to do.
And we to do this very simply by modifying our cookies and changing our user ID to user ID number one.
So this was possible because the cookies that are used are very simple now cookies should be more complicated
so that they should actually use what's known as session IDs or tokens these tokens should be very complicated
and not relate to the user ID.
That way I wouldn't be able to know what the user ID even if I know that the admin has a user id of
one.
I wouldn't be able to know what token that admin is using.
So they should be dynamically generated based on each user and they should vary from time to time.
So even for the same user every time he logs in they should get different token randomly based on some
parameters so that it's very difficult for anybody to know what tokin each user gets.
Otherwise it will be very easily for people to guess what can the admiral or any other user has and
just injected into their browser.
Now using complicated tokens and session IDs is still vulnerable for a man in the middle attacks and
we've seen that in plugins like fire sheep and in programs like ferret and Hamster where I actually
explained that in my network penetration testing course where you could gain access to any user account
as long as the people are on the same network as you.
So even if the token is really complicated you'll be able to capture that token and then inject it into
the browser.
But the main idea is the Web site is not vulnerable because you can't guess it yourself.
You have to actually capture that token from another person and then injected whereas in here we were
able to just know or guess that the admin has an idea of one injected and then log in as admin.