Original subtitles

welcome back guys the

second bug from our list of

five carefully selected bugs how to get

access to the account

of the logged out user

so let me make some kind of introduction

when the user has been authenticated to

the web application so the

authentication is typically

you know providing email and password

then the only

piece of data that is used by the web

application

to recognize the user is a cookie with

session id

the so-called authentication cookie

and this is what you let's say have to

know at the very beginning

of our journey in this case now

i'm gonna tell you something about log

out functionality right

so the user is going to log out

and what typically happens in in web

applications is like this

when the user logs out the

authentication cookie

is deleted from the user's browser

well it's deleted from the user browser

so the user can no longer

go to his profile because well the user

seems to be no longer logged in

right because there is no authentication

cookie it has been deleted

but the question is right now does it

actually mean

that the user is really locked out well

the cookie was deleted from the user's

browser but

is it enough the answer is no

it's not enough it's it's definitely not

enough

because the authentication cookie has to

be invalidated on the server side

at the time of logging out in other

words

it doesn't matter what happens on the

client side so what happens in the

browser of the user

like you know deleting the cookie with

session id

it doesn't matter what matters is what

happens on the server side

so you have to invalidate the

authentication cookie on the server side

at the time of logging out

then the user is really logged out

if it doesn't happen then the attacker

can get access to the account

of the logged out user

and now let me explain even more when

you just delete

the authentication cookie from the

browser of the user

then the user seems to be locked out but

from the point of view

of the server from the point of view of

the web application

the user is still logged in

right so this is it

this is a kind of maybe mysterious at

the very beginning that the user seems

to be

logged out but in fact he is still

logged in but this is how it works

now i believe that you follow my

reasoning

and i have seen quite many web

applications

that were vulnerable to this kind of

attack

and of course the impact here is very

nice it's like you know

getting access to the account of the

logged out user

very nice very very cool so now without

further delay

let me jump to the demo let me show you

how it really works

i really want you to understand all the

details here

and i want you to be able to check if

the web application

of your own choice is vulnerable to this

problem or not

so let's jump right now to the demo