Stealing Web Browser Cookies ben-holland.com Whats a cookie? Web - PowerPoint PPT Presentation

Jan 16, 2023 •633 likes •712 views

Stealing Web Browser Cookies ben-holland.com Whats a cookie? Web 2.0 Cookies provide state Examples: Items in shopping cart AuthenFcaFon! Cookies Passwords! Username + Password = Cookie If I know your authenFcaFon

Stealing Web Browser Cookies ben-holland.com
What’s a cookie?
Web 2.0 – Cookies provide state Examples: • Items in shopping cart • AuthenFcaFon!
Cookies ≥ Passwords! • Username + Password = Cookie • If I know your authenFcaFon cookie value I don’t need your password! • SomeFmes cookies don’t expire for a really long Fme…
How can I get your cookies? • Packet sniffing (wiretapping) – Wired networks – Wireless networks • (IASTATE vs eduroam) – HTTP vs. HTTPS – hUps://www.cookiecadger.com/ – hUps://github.com/benjholla/tssk
How can I get your cookies? • XSS (Cross Site ScripFng) AUacks – How about you just send me your cookies… – HTTP Only Flag
How can I get your cookies? • Client Side AUacks – Browsers store cookies in a file… – hUps://github.com/benjholla/CookieMonster

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Retroactively estimating system clock skew from stored web browser cookies Contents 1. Why? 2.

Retroactively estimating system clock skew from stored web browser cookies Contents 1. Why? 2. Mechanism for deriving skew from cookies 3. Data & data processing 4. Demonstration of algorithm Time. It matters. John is a suspect in a

470 views • 15 slides

COOKIES How can apps maintain user state? Cookies! small bits of data downloaded to your

CS 498RK FALL 2017 COOKIES How can apps maintain user state? Cookies! small bits of data downloaded to your computer so that a site can remember you and what you did on subsequent visits Browser Server first request http:/

475 views • 23 slides

Browser and Network request Browser website CS 4803 reply Network OS Computer and Network

Browser and Network request Browser website CS 4803 reply Network OS Computer and Network Security Hardware Alexandra (Sasha) Boldyreva Browser sends requests May reveal private information (in forms, cookies) Web security.

517 views • 7 slides

Cookies Cookies HTTP is stateless To "remember" a user we use cookies In a

Cookies Cookies HTTP is stateless To "remember" a user we use cookies In a response header, we can give the user information as a cookie All subsequent requests will contain these cookies in a header Since cookies work

475 views • 10 slides

Cookie Protocol Server sets cookies in response header: Set-Cookie: session=0x4137f;

Cookie Protocol Server sets cookies in response header: Set-Cookie: session=0x4137f; Expires=Wed, 09 Jun 2012 10:18:14 GMT Name Value Expiration Time Browser returns cookies in headers of later requests: Cookie: session=0x4137fd6a CS

701 views • 4 slides

CSRF Recall: Session using Cookies Browser Server POST/login.cgi r o a t c i n t e h

CSRF Recall: Session using Cookies Browser Server POST/login.cgi r o a t c i n t e h t u a e : i o k o c t - e S G E T C o o k i e : a u t h e n t i c a t o r e s n o p s e r How it

363 views • 17 slides

Graphing Crumbling Cookies AdKDD 2019 Matt Malloy, Jon Koller and Aaron Cahn What is a device

Graphing Crumbling Cookies AdKDD 2019 Matt Malloy, Jon Koller and Aaron Cahn What is a device graph? a dataset that organizes digital identifiers that we create as we use the internet identifiers (IDs): browser cookies or advertising

284 views • 11 slides

Browser forensics: Adblocker extensions Willem Rens (UvA MSc SNE student) Supervisor: Johannes

Browser forensics: Adblocker extensions Willem Rens (UvA MSc SNE student) Supervisor: Johannes de Vries (Fox-IT) Why traditional browser forensics may not work Cleared Cookies Cache History Sometimes recoverable, Jeon et

786 views • 44 slides

Cookies and Sessions Thierry Security assumptions You have absolutely no control on the client

Cookies and Sessions Thierry Security assumptions You have absolutely no control on the client Client Side Server Side Web Server Database Web Browser Cookies The big picture key/value pairs data Client Side Server Side HTTP request

783 views • 13 slides

Browser Storage Andrew Sutherland Mozilla DOM Team Current Cross-Browser Storage APIs

Browser Storage Andrew Sutherland Mozilla DOM Team Current Cross-Browser Storage APIs Cookies: Synchronous, Strings, Hard Storage Cap LocalStorage: Synchronous, Strings, Hard Storage Cap IndexedDB: Asynchronous, Structured

481 views • 7 slides

A bug bounty tale: Chrome, stylesheets, cookies, and AES Pepe Vila Software Seminar Series (S3)

A bug bounty tale: Chrome, stylesheets, cookies, and AES Pepe Vila Software Seminar Series (S3) Thursday, December 14, 2017 file URI scheme Q: Who opens downloaded HTML or PDF files with the file://host/path browser? In a HTTP(s) scheme the

665 views • 27 slides

Browser Security Part 2 Recap XSS 3 different types Common aim/theme Steal user

Browser Security Part 2 Recap XSS 3 different types Common aim/theme Steal user credentials (session ID, cookies, etc.) CSRF Cross-Site Request Forgery is an attack that forces an end user to execute unwanted actions on a

428 views • 23 slides

PEXit PRIVACY and COOKIES POLICY This PRIVACY and COOKIES POLICY conveys how PEXit collects, uses,

PEXit PRIVACY and COOKIES POLICY This PRIVACY and COOKIES POLICY conveys how PEXit collects, uses, shares, stores and manages your information. We have built our business based on (a) our integrity, (b) our sincere effort to meet your

206 views • 3 slides

WORK STEALING SCHEDULER 2 6/16/2010 Work Stealing Scheduler

1 6/16/2010 Work Stealing Scheduler WORK STEALING SCHEDULER 2 6/16/2010 Work Stealing Scheduler Announcements Text books Assignment 1 Assignment

476 views • 32 slides

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th edition and online Perl Chapter of textbook) Cookies Example 1 JavaScript: Using Cookies Cookie Data stored on _____________ to maintain

263 views • 9 slides

Should Internet Cookies Be Further Regulated by the Government? Research Presentation by

Should Internet Cookies Be Further Regulated by the Government? Research Presentation by Kaitlin Burdick Overview Background Arguments For the Regulation of Cookies Arguments Against the Regulation of Cookies Conclusion

319 views • 13 slides

jsprobes cross-platform browser instrumentation using JavaScript Brian Burg (@brrian /

jsprobes cross-platform browser instrumentation using JavaScript Brian Burg (@brrian / burg@cs.uw.edu) Background: browser research template 1 2 3

781 views • 23 slides

TrustJS: Trusted Client-side Execution of JavaScript David Goltzsche 1 , Colin Wulf 1 , Divya

Motivation Approach of TrustJS Evaluation Conclusion TrustJS: Trusted Client-side Execution of JavaScript David Goltzsche 1 , Colin Wulf 1 , Divya Muthukumaran 2 , Konrad Rieck 1 , Peter Pietzuch 2 and R udiger Kapitza 1 1 TU Braunschweig,

1k views • 23 slides

Browser Development Tools by Rusty Keele Altair 8800 (1975)

Browser Development Tools by Rusty Keele Altair 8800 (1975) https://www.flickr.com/photos/mratzloff/9169309781/ Who This Presentation Is For Anyone who wants to learn about browser developer tools Basic knowledge of HTML, CSS and

871 views • 24 slides

An Analysis of Private Browsing Modes in Modern Browsers

Stanford Computer Security Lab An Analysis of Private Browsing Modes in Modern Browsers Gaurav Aggarwal, Elie Bursztein, Collin Jackson, Dan Boneh Usenix

653 views • 40 slides

Offline First @caolan Unlike the always-wired machines of the past, computers are now truly

Offline First @caolan Unlike the always-wired machines of the past, computers are now truly personal, and people move through online and offline seamlessly our apps should do the same More often than not, the mobile experience for a

1.48k views • 124 slides

The Hardware/So<ware Interface CSE351 Winter 2013 Memory and

University of Washington The Hardware/So<ware Interface CSE351 Winter 2013 Memory and Caches I University of Washington Roadmap Data & addressing

501 views • 23 slides

Roadmap Memory & Data Integers/FP Machine code

University of Washington Roadmap Memory & Data Integers/FP Machine code Assembly programming (x86) Procedures/Stacks Memory and caches

723 views • 28 slides

The power of the network Andrew Betts Principal developer advocate | Fastly Who is this guy?

The power of the network Andrew Betts Principal developer advocate | Fastly Who is this guy? Developer relations at Fastly W3C Technical Architecture Group Previously Financial Times, Nikkei Agenda today Why you should

1.1k views • 92 slides