Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user?

I am successfully able to perform a cookie replay attack on the same system, but I want to try if the cookie replay attack is possible from an external system. Is this possible?


I'm not really sure what you exactly mean with "cookie replay attack" but I assume that you mean using a captured cookie by the attacker for session hijacking by reusing a captured session cookie.

If this is possible depends on which information the web application associates with the cookie. If it associates a browser fingerprinting or SSL session information with the cookie it might detect session hijacking when the attacker uses another browser. If it associates the IP address of the client with it it might detect if the cookie is used from another client IP address. If it does not associate any such or similar information with the cookie it will not be able to detect the session hijacking.

  • Thanks for replying Steffen. You are right! It's Session hijacking by capturing cookie. Let me explain the scenario, using social engineering I capture cookie information of an authenticated user. Once the user logs out of the application, i try to login into the application using the captured session cookie. I successfully logged into the application. So pre-requisite required for this attack to happen is I need to have physical access for the machine that user has used. Now my question is will i be able to perform this attack using 'remote' access(provided I have captured session cookie)? – JuniorISE Dec 18 '15 at 7:31
  • @JuniorISE: which part of your question is not answered in my answer? To repeat, it depends what kind of associations the application associates with the cookie. Apart from that, it would be a really bad design of the application if you could reuse a cookie after the user has logged out. – Steffen Ullrich Dec 18 '15 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.