Original subtitles

welcome in the demo

let's play with the authentication

cookie as you can see in the upper right

corner you see my name

david you see that i am really logged in

because you see

my profile what i'm going to show you

right now is

again i'm going to show you my cookie

with session id so let me go to

cookies manager and yeah here it is

um the name of the cookie is phpsys id

you see some

random value out there it's random it's

long it's good

the host is example.com but let's take a

look at

this stuff send for

any type of connection

this is really really cool for

hackers because it basically means that

this cookie can be sent over insecure

http

or secure https

so this is a clear message for me for

tester for hacker

that this cookie has been set without

secure attribute and now i'm gonna show

you that indeed

this cookie can be disclosed over

insecure

http okay

so far so good let me now do something

like this i'm gonna

intercept the outgoing request from my

browser

i'm going to send the request over http

and i'm going to

intercept this request and i'm going to

show you that this cookie

with session id can be disclosed over

insecure http

request right okay so in order to do it

i need a kind of

interceptor and what i've got in my

testing environment

is a proxy with interceptor actually

so i'm using here burp suite which is an

integrated tool for web app security

testing one of the functionalities out

there

in this tool is a proxy and in this

proxy we had an interceptor so that you

can

really intercept the outgoing traffic

you know from the browser and that's

exactly what i'm gonna do right now

i'm gonna send the request over http and

i'm gonna

i'm gonna just intercept this request

okay so

let me now go to my web application

let me go to web application and now you

see that well my web application is

protected by https https

secure it guarantees confidentiality

integrity and

authentication but i'm going to send the

request over http

over insecure protocol right

http is insecure this is just plain text

and now i'm gonna you know send out this

request

and and you will see how this request

looks like

in the proxy so in the real

attack scenario i'm going to send a link

over http to victim the victim is going

to click the link

and the attacker the so-called man in

the middle can can see the traffic

uh sending the plaintext because http is

plain text right

so let me now do it let me hit enter

and this is my request as you can see

there's a request

goes over insecure http

to domain example.com and what is

crucial

in this demo is that the

cookie with session id has been

appended to this request so what we've

got here

is a disclosure of cookie with session

id

over insecure http voila the game over

now the man in the middle can get access

to my account right

beautiful and now let me show you

something even more interesting i mean

more interesting

and maybe it will be a kind of

eye-opener for you

because i told you that this kind of

attack works

in the web application protected by

secure https

and indeed you saw that my web

application

is protected by a secure https but let

me now take this request

click right and send to repeater

i want to show you something i want to

have on one screen the request and

response right

and i'm gonna send this request again

so let me click go now there is

something very interesting

please take a look on the left side

we've got the request

the request as you already know goes

over

insecure http and our cookie has been

disclosed

right over insecure http but the

response is very interesting

in the response you see something like

this here

301 moved permanently

and the location is here the location is

https column slash

example.com profile.php so the web

application is trying to redirect

you to secure https

protected version of profile.php right

so you you see that indeed https is

enforced in this web application right

every single attempt to reach a given

resource via

http results in https redirection right

or redirection to https protected

resource

but be really careful here

the leakage of cookie with session id

happens before the redirection

this is beautiful so even if you've got

this redirection you see the response

you are redirected to secure

https protectedpageprofile.php

this is good that you've got this https

enforcement but

the leakage happened before

the redirection that's why enforcing

https

or having https protected a web page

is not enough you here clearly see

that when you don't process the cookie

security

then the leakage happens before the

redirection

and the game is over i believe that this

is clear for you this is

really an eye-opener for many people

because

people think that https solves all

problems now well not necessarily

here you see an interesting and attack

scenario that can happen in https

protected

a webpage so i believe this is clear i

believe that now you can

check if this kind of problem can happen

in your own web application or

in the web application that you are

testing so

let's finish this demo and let's

jump to another bug the bug number five

on our list