10

I'm new with security and have a few questions about it. I've searched and found that for example Google Chrome stores cookies in ~/.config/google-chrome/Default/Cookies. Just as an experiment I "stole" this file (from my VM) and put it in my directory. But I could not access anything, not Google Chrome account nor anything.

This is just for educational purposes. How do hackers steal a Google account or any other cookie by actually copying the victims cookie?

6

You cannot steal a Google account credentials by simply looking at cookies. Cookies are used for "session purposes". When you perform login on google you store cookies that (to put it simply) reminds google that you are authenticated but credentials are not saved insider cookies.

What you could think of is stealing a session (Session Hijacking) like attempting an attack of cross-site request forgery so you can perform some actions as the logged user. Or search some vulnerabilities like Session Framing (highly unlikely).

If you want to play around with cookies on chrome you can download this extension that shows you the cookies for every session you open: EditThisCookie.

If you are interested in Web application vulnerabilities I also recommend you to take a look at some CTF games (capture the flag). For an entry level you can take a look at picoCTF that has many types of challenges including web application ones.

  • thank you very much for your answer. But anyway, credentials are stored somewhere, where are they and is cookies and credentials enough to login with different account or does it have some additional security? also big thanks for providing CTF games challenge. – Rasty Dec 15 '16 at 17:59
  • Let me understand. It seems you are basically trying to hack yourself (or someone or a user on your computer) and swap your chrome configurations (credentials + cookies) with those of another user? and so trick chrome believing you are another user? – inno15 Dec 15 '16 at 18:30
  • I'm trying to figure what amount of information is needed to do that. – Rasty Dec 15 '16 at 18:38
  • Theorically you need to have all the configuration files that the chrome browser uses to handle it's authentication. To know exactly what you need, reverse engineering might be needed and even then there would probably be some security features that prevent it. If you manage to do that let me know, it'd be surely one hell of a vulnerability – inno15 Dec 15 '16 at 19:31
  • love the reference to CTF <3 – dwkd Dec 15 '16 at 21:27
5

How do hackers steal a Google account or any other cookie by actually copying the victims cookie?

This is how cookies work in general:

A user's session cookie acts as their credential after they've been authenticated and until they are signed off. A user provides valid username/password and gets a session cookie in return. Its this cookie that each subsequent HTTP request needs to present to the server so that it knows the 'context' of the request. This ensures that a user isn't asked for the username/password for each page/request.

Hence, if you obtain the session cookie of a logged in user, you can essentially impersonate him/her without actually knowing their password. A very common method to steal cookies are our beloved XSS attacks. However, a good combination of CSP settings and protections like XSS auditor combined with httpOnly cookies thwart most XSS attacks. If you find one on gmail, you'll probably get a hefty sum of $$ via their bug bounty program ;)

CSRF is another way how attackers make servers perform changes that weren't authorized or initiated by the user. There was a cute CSRF attack on gmail where a attacker could send POST requests to create an email filter on user's account which will essentially forward a copy all emails to an email of attackers choice. Read about it at: https://www.wired.com/2007/09/gmail_flaw_lets_anyone_read_your_e-mail/

Obviously there are bunch of other attacks that can be leveraged to compromise user's account or data in some way or the other.

4

This is how it's done.

Go to some site, let's say facebook/netflix .

Check out the cookies that the site uses to authenticate you, you can edit the cookies from the dev tools! just mess around with them, edit them until you refresh the page and you are logged out, try to figure out what are the cookies that hold your session ID.

In facebook's case the cookies that are required are called "c_user" and "xs"

enter image description here

if you open a diferent browser (say firefox) or a diferent computer and paste those cookies while you are on facebook's domain using the dev tools, then you will be able to resume your previous session, that's session hijacking

You can add cookies on firefox on the development tools, under storage, by pressing that Plus button.

enter image description here

Facebook might complain, because it will see that you suddenly changed the user agent (or some other way of fingerprinting who you are) and will likely send you a notification asking about "suspicious activity" on your account.

The "cookies" file you mention is a SQLite database that contains ALL these cookes, you can open it with sqlite browser and check them out yourself. The actual values of the cookies have been encripted in recent versions of chrome, so they cant be viewed from the sqli database so easily.

A few ways of getting the content of cookies from someone else are:

  • If the cookie is sent over HTTP instead of HTTPS and you are in a shared wireless network, you can sniff the traffic and get the cookie

  • If the cookie is not marked as HttpOnly then it can be read by javascript, if you can add some javascript to the site (this is called Cross site scripting) then you can read the cookies content and ask javscript to send that to some server you control.

After you have the cookie, you just insert it into the browser as shown above and you are done.

Usually important cookies are marked with the parameters

  • secure - It can only be sent over HTTPS
  • HttpOnly - It can only be used on requests, javascript has no access to it

So they are much harder to steal.

For more information on cookies you may want to read Their specifications

Edit: just realized that this question is so old. for some reason it appeared on the site's front page.

  • You know those redactions in the first image are pretty much useless if you want to hide the values of the cookies, right? There's nothing wrong with answering an old question BTW. – forest Mar 29 '18 at 6:43
  • not I dont, why? I wanted to hide the XS and the c_user, the other ones i dont really care about. – Joaquin Brandan Mar 29 '18 at 6:44
  • Well because you only partially scribbled over them. You can still see what most of the characters are. You could probably partially get some of what was in c_user. Not xs though. I was mostly talking about the other cookies. – forest Mar 29 '18 at 6:45
  • "xs" and "c_user" are properly completely covered, the others are not part of the session, and they are actually a lot longer than shown. Thanks for the concern!. I might actually nuke all the cookies now and get fresh ones just in case :P – Joaquin Brandan Mar 29 '18 at 6:46
  • 1
    There might be a typo: the flag is not "safe" but "secure" - right? See examples on rfcreader.com/#rfc6265_line269 – zipizap May 6 at 22:08
0

I presume the reason your "Cookie stealing" method did not work is because the cookies are encrypted and only the computer on which they are encrypted can decrypt it, it's a feature of windows.

Also read more about cookie hijack.

0

As for Firefox I think you need to copy the whole Chrome profile folder '~/.config/google-chrome/Default', not only the the folder that holds the cookies

Alternatively you can 'steal' the cookies by using the Chrome Developer tools, you can view the cookies values on VM machine, and then in the host use the same to set cookies values by executing js code on the console :

document.cookie = name + "=" + value + expires + "; path=/";

protected by Community May 15 at 4:15

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.