1

I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie.

The web application is written in .Net so I have added this content to web config:

<httpCookies requireSSL="true" />

After that I checked application in browser with the "Advanced Cookie Manager" add-on in Firefox.

Results of Advanced Cookie Manager: some attributes IsSecure values are true, some are false.

I want to check to see if this is a false positive - how else can I re-check secure attribute.

Improve this question
11
  • What are you asking here? Can you not recheck with the same tool you used to check in the first place?
    – Rory Alsop ♦
    Commented Dec 31, 2013 at 12:15
  • Commercial tool(Ibm appscan) gived same results.I want to test for false positive or not.
    – dgn
    Commented Dec 31, 2013 at 12:25
  • The simple answer would be to use another tool - but you could use burp or another proxy to look at the data your web application sends.
    – Rory Alsop ♦
    Commented Dec 31, 2013 at 12:30
  • Have you deleted all the old cookies that won't be used any longer anyway, if you require the secure flag from your change to the configuration onwards? Could be it's those that are confusing matters?
    – TildalWave
    Commented Dec 31, 2013 at 12:30
  • 2
    Otherwise, what you want to inspect is Web Request from the client that will include all the cookies in the request header. In Firefox, you can do that via Developer Tools' Web Console (CTRL+Shift+K). Then reload the page you're inspecting, find the first GET request in the list with the matching URL you're evaluating and click on it. In Chrome, you can open Developer Tools with CTRL+Shift+J, select Network tab, and then it's the same as in Firefox.
    – TildalWave
    Commented Dec 31, 2013 at 12:50

2 Answers 2

Reset to default
2

Cookies can be set multiple times which can result in insecure cookie attributes (Secure and HTTPOnly) and race conditions. Tools can produce false positives, what really matters is if the browser is using the flag properly. To viewing the cookie's security attributes within the browser's developer console (ctrl+shft+j).

If the cookie is being set multiple times, the challenge is finding the misconfigured request handler. Here is the process for tracking down the culprit:

  1. Open a new private window in firefox or chrome.
  2. Open the developer console (ctrl+shift+j)
  3. Load the page that is responsible for setting the secure cookie.
  4. Look at every HTTP request that contains a set-cookie HTTP header element. find one that doesn't have the Secure flag.
Improve this answer
0

Use a sniffer like HTTP Analyser , Then access your website . You will get everything which came and went from your browser .

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .