Tag Info

New answers tagged

1

You can't read PHP code with an include() or require() because these functions evaluate the PHP code within a file. If you can control the beginning part of the string passed to include() or require() then you can use a php://filter to read php files, but this attack pattern does not apply for this bug. In order to get a shell with this LFI vulnerability, ...


1

It works perfectly fine for me with eng.php/../../../anotherfile (I'm using PHP 5.5.6-1). Are you sure that anotherfile.php is in the correct directory? Try placing it in the same directory as the lang php files and include it there (just for testing). is it readable by the web server? (for testing, you can just chmod 777 file.php). Also note that while ...


1

Sigh. Here is the reasoning for me posting a link in lieu of a long answer. Original post wants to inject/disaffect/exploit through the lang variable in cookie: GET /en-us HTTP/1.1 Cookie: xxx=eng.php/../../../anotherfile He then states he tried and failed: ErrorException: ...


-1

I recommend reading the following: http://labs.neohapsis.com/2008/07/21/local-file-inclusion-%E2%80%93-tricks-of-the-trade/


7

...php writes the cookie into a file. (I think that is one of the normal processes). From what you wrote above, it seems that there could be some misconception with your understanding on how a session is being created and maintained on a website. When a user logs in to a website, a session id is generated and this id is stored in a special cookie, ...


4

You can use JavaScript to set the cookie in your browser: document.cookie = 'cookie1=test; expires=Fri, 3 Aug 2022 20:47:11 UTC; path=/' Just need to open a console by pressing F12 or place the JavaScript in a webpage. See http://stackoverflow.com/questions/14573223/set-cookie-and-get-cookie-with-javascript


1

There are different ways of actually doing it, all boiling down to the same thing: Usually, your browser should allow you to modify stored cookie value, just replace the current value by the one you've stolen There are numerous browser addons & plugins that allow you to tamper your request before sending it, you can add or modify your cookie value on ...


5

AFAIK, using stolen cookies depends on the browser you are using. For instance firefox stores cookies in a not-plain-text file cookies.sqlite in which you can't just copy/past the cookie's key/value. Firebug gives you the ability to add/edit cookies for the targeted website.


2

You can read the values of cookies using document.cookie or other client side solutions only if that particular cookie is not flagged as HttpOnly (assuming the browser you're using supports this flag).


0

If you don't want to share keys AND you use asymmetric keys then you can key each server separately and have each server set a different iss (issuer) claim. Then the recipient of the JWT can "look up" the appropriate public key based on the iss claim. Our lookup was basically a config file that mapped the iss value to a file system location of the public ...


2

Yes and no. If done right it will be, but what you are describing is simply an authentication cookie. I would suggest to not reinvent the wheel. The framework/programming language that you use probably already have a way to manage authentication cookie. I would go with that instead of creating it yourself.


16

There is indeed an EU legislation : European Union Directive 2009/136/EC says that websites must get consent from their visitors about information they intend to keep/store/retrieve on their computer/device. There is even a fine, up to £500,000 for those who don't comply. Source : ICO (Information Commissione's Office) Blog European Comission ...


6

The intent would have been to exploit a server side include -- your webserver retrieving the URL and incorporating it into the web page. This vulnerability isn't very common anymore.


1

This is a quite a broad question in that this could be (and has been) implemented in any of a large number of different ways. They generally involve storing a persistent cookie in the browser, and here are a few. The cookie might contain: An authentication token. (As Tokk described in his answer.) With state on the server (in the database, for instance) ...


-1

The credentials are never stored either at the user end or at the server end(if configured as per security standards). If you want to keep your session active for a long time, or make sure your password is remembered next time when you login, then the browser communicates with the server to generate a random set of data that is stored in the form of Cookies. ...


4

Usaually the user's browser stores some cookies with a random string identifying the user on the server. More secure variants of this additionally check other parameters as the browser version, OS of the user and approximate location. Basically, if you visit a webpage like facebook with a cookie, you get authenticated only with the random string in the ...


1

By https-only I'm assuming you mean the HTTP Only flag, although it is accessed over HTTPS. The non HTTP Only cookies could be compromised if there are any XSS flaws on the website. The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer). This would be a MITM attack on a ...


-1

Finally I have found the answer. If we are able to steal someone's(Say user John) cookies and gain access to their sessions, we are able to do this only if the user (John) is logged in to his account from somewhere else. It is actually called session fixation. But once if he has logged out, the value of cookie for that session gets expired and the attacker ...


3

Disabling 3rd party cookies is largely a privacy measure. Cookies are restricted with a Same Origin Policy (SOP), which essentially mandates that a site on domain A can't set a cookie for domain B, and your browser shouldn't send cookies for domain A when visiting domain B. This is largely for security reasons: you don't want sites being able to read ...


0

Perhaps the best thing is to read up on OWASP, refine your definition of 'session recreation' based on what you read there, and decide what the difference is yourself. Without wishing to sound flippant, you've got a few of us here discussing what you mean by that, so instead of a lot of back and forth, that may be the way forward. I linked the session ...


0

In the context of security in session management the recreation of the session is recommended after login or any privilege changes. According also to the OWASP session management cheat sheet: """ The session ID regeneration is mandatory to prevent session fixation attacks [3], where an attacker sets the session ID on the victims user web browser instead of ...


0

Like Paraplastic2 alread stated: With session fixiation you create a malicious session (one you control) first and try to get a use to use this "prepared / fixiated" session, so you can Access the session Information (data you want to manipulate or steal). The term session "recreation" does not seem to be that commonly used as you cannot find that much ...



Top 50 recent answers are included