Is it possible to see if a script on a website steals session cookies?

Question

I'm looking as some web analytics solutions, I know it sounds paranoid.
but cookie-based web analytics need for you to paste their JavaScript code on your web-site.

I don't like the idea too much of just pasting scripts on my web-site that I don't know.
So I want to check if these scripts send to another server the session cookies of my website's users.

Some ways I though of are:

1. Use firebug to see all the requests made - the problem is that the script might encrypt the cookies in some way so I won't see the cookies as plaintext.

2. Search the JavaScript code for terms like "document.cookie"

What do you think?
And will setting the session cookie to HttpOnly completely disable this?

Thanx in advance.

Answer 1

I think your premises does not get the whole issue:

• The script you embed from external sources can be changed at a later time.

• Stealing the session cookie is just an easy way to leverage and XSS vulnerability. Instead of stealing the cookie and using it from another computer to do malicious things, the malicious script can do those things directly without steeling the cookie. This has a number of advantages from the attackers point of view:

  1. It works with the HttpOnly flag since the script just sends the request using the normal browser means such as submitting a form. This can be done in an hidden iframe
  2. It does not reveal the ip-address of the attacker to the server. This is especially true in the context of reflective XSS attacks.
  3. It does work with additional authentication mechanisms such as http basic auth or binding the session to the client ip-address.

Answer 2

You could actually detect it by overriding the cookie getter using __definegetter__ :

document.__defineGetter__("cookie", function() { /*report stolen */ });

However this can be undone by the javascript in question using:

delete document.cookie;

before trying to access it.

In ECMASCRIPT 5, the new javascript standard, you can actually override it in a way that it can't be undone.

Object.defineProperty(document, "cookie", { get: function() { /* report stolen */ }, set: function() { }, configurable: false })

The configurable flag makes it impossible for script loaded later in the page to override or delete.

Though as mentioned in other answers, the script can do anything on behalf of the user (CSRF), so I'm not sure this will get you anywhere.

Answer 3

First of all - yes, settings cookies as HttpOnly will prevent any JavaScript code to access your cookies in commonly used browsers.

You can search the script for document.cookie, but it can be obfuscated and you cannot be sure if you think about all ways the attacker can access cookies. One example could be:

var a="cookie", b;
for(c in document) {
    if(c == a) b = document[c];
}
alert(b);

I'm sure there are other ways how to hide your intention, when trying to attack the web page. About the requests inspection - could be interesting to see what's going on, but as you stated, the request parameters can be encrypted and you would have to reverse engineer the encryption algorithm from the 3rd party JavaScript code, which could be very time consuming.

Answer 4

Unless they're being very careful, you can learn by traffic analysis.

Create a version of the page with x kB of cookies and then observe that they send messages totaling y kB.

Create a version of the page that is the same in all respect but that has x' kB of cookies where x' is significantly larger than x but still within the range of cookies that a normal page might have. Observe that they send messages totaling y' kB.

If y is quite different from y' then you should be very suspicious.

And will setting the session cookie to HttpOnly completely disable this?

Yes, on the browsers that support it.

Answer 5

If you attach a debugger to document.cookie and watch for any calls to it then you can see everything the script does with said cookies.

Setting the session cookie to HttpOnly would stop newer browsers from passing the cookie to javascript, but older browsers don't understand HttpOnly.