2

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user?

I am successfully able to perform a cookie replay attack on the same system, but I want to try if the cookie replay attack is possible from an external system. Is this possible?

1 Answer 1

5

I'm not really sure what you exactly mean with "cookie replay attack" but I assume that you mean using a captured cookie by the attacker for session hijacking by reusing a captured session cookie.

If this is possible depends on which information the web application associates with the cookie. If it associates a browser fingerprinting or SSL session information with the cookie it might detect session hijacking when the attacker uses another browser. If it associates the IP address of the client with it it might detect if the cookie is used from another client IP address. If it does not associate any such or similar information with the cookie it will not be able to detect the session hijacking.

2
  • Thanks for replying Steffen. You are right! It's Session hijacking by capturing cookie. Let me explain the scenario, using social engineering I capture cookie information of an authenticated user. Once the user logs out of the application, i try to login into the application using the captured session cookie. I successfully logged into the application. So pre-requisite required for this attack to happen is I need to have physical access for the machine that user has used. Now my question is will i be able to perform this attack using 'remote' access(provided I have captured session cookie)?
    – JuniorISE
    Commented Dec 18, 2015 at 7:31
  • @JuniorISE: which part of your question is not answered in my answer? To repeat, it depends what kind of associations the application associates with the cookie. Apart from that, it would be a really bad design of the application if you could reuse a cookie after the user has logged out. Commented Dec 18, 2015 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .