I'm new with security and have a few questions about it. I've searched and found that for example Google Chrome stores cookies in ~/.config/google-chrome/Default/Cookies. Just as an experiment I "stole" this file (from my VM) and put it in my directory. But I could not access anything, not Google Chrome account nor anything.
This is just for educational purposes. How do hackers steal a Google account or any other cookie by actually copying the victims cookie?
This is how it's done.
Go to some site, let's say facebook/netflix .
Check out the cookies that the site uses to authenticate you, you can edit the cookies from the dev tools! just mess around with them, edit them until you refresh the page and you are logged out, try to figure out what are the cookies that hold your session ID.
In facebook's case the cookies that are required are called "c_user" and "xs"
if you open a diferent browser (say firefox) or a diferent computer and paste those cookies while you are on facebook's domain using the dev tools, then you will be able to resume your previous session, that's session hijacking
You can add cookies on firefox on the development tools, under storage, by pressing that Plus button.
Facebook might complain, because it will see that you suddenly changed the user agent (or some other way of fingerprinting who you are) and will likely send you a notification asking about "suspicious activity" on your account.
The "cookies" file you mention is a SQLite database that contains ALL these cookes, you can open it with sqlite browser and check them out yourself. The actual values of the cookies have been encripted in recent versions of chrome, so they cant be viewed from the sqli database so easily.
A few ways of getting the content of cookies from someone else are:
If the cookie is sent over HTTP instead of HTTPS and you are in a shared wireless network, you can sniff the traffic and get the cookie
If the cookie is not marked as HttpOnly then it can be read by javascript, if you can add some javascript to the site (this is called Cross site scripting) then you can read the cookies content and ask javscript to send that to some server you control.
After you have the cookie, you just insert it into the browser as shown above and you are done.
Usually important cookies are marked with the parameters
So they are much harder to steal.
For more information on cookies you may want to read Their specifications
Edit: just realized that this question is so old. for some reason it appeared on the site's front page.
c_user. Not xs though. I was mostly talking about the other cookies.
You cannot steal a Google account credentials by simply looking at cookies. Cookies are used for "session purposes". When you perform login on google you store cookies that (to put it simply) reminds google that you are authenticated but credentials are not saved insider cookies.
What you could think of is stealing a session (Session Hijacking) like attempting an attack of cross-site request forgery so you can perform some actions as the logged user. Or search some vulnerabilities like Session Framing (highly unlikely).
If you want to play around with cookies on chrome you can download this extension that shows you the cookies for every session you open: EditThisCookie.
If you are interested in Web application vulnerabilities I also recommend you to take a look at some CTF games (capture the flag). For an entry level you can take a look at picoCTF that has many types of challenges including web application ones.
How do hackers steal a Google account or any other cookie by actually copying the victims cookie?
This is how cookies work in general:
A user's session cookie acts as their credential after they've been authenticated and until they are signed off. A user provides valid username/password and gets a session cookie in return. Its this cookie that each subsequent HTTP request needs to present to the server so that it knows the 'context' of the request. This ensures that a user isn't asked for the username/password for each page/request.
Hence, if you obtain the session cookie of a logged in user, you can essentially impersonate him/her without actually knowing their password. A very common method to steal cookies are our beloved XSS attacks. However, a good combination of CSP settings and protections like XSS auditor combined with httpOnly cookies thwart most XSS attacks. If you find one on gmail, you'll probably get a hefty sum of $$ via their bug bounty program ;)
CSRF is another way how attackers make servers perform changes that weren't authorized or initiated by the user. There was a cute CSRF attack on gmail where a attacker could send POST requests to create an email filter on user's account which will essentially forward a copy all emails to an email of attackers choice. Read about it at: https://www.wired.com/2007/09/gmail_flaw_lets_anyone_read_your_e-mail/
Obviously there are bunch of other attacks that can be leveraged to compromise user's account or data in some way or the other.
I presume the reason your "Cookie stealing" method did not work is because the cookies are encrypted and only the computer on which they are encrypted can decrypt it, it's a feature of windows.
Also read more about cookie hijack.
As for Firefox I think you need to copy the whole Chrome profile folder '~/.config/google-chrome/Default', not only the the folder that holds the cookies
Alternatively you can 'steal' the cookies by using the Chrome Developer tools, you can view the cookies values on VM machine, and then in the host use the same to set cookies values by executing js code on the console :
document.cookie = name + "=" + value + expires + "; path=/";
