Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here.

While I do not like to make these type of posts I cannot find anything about this type of attack. Google "cross" yields that it might be session fixation? But, I'm not sure.

1 Answer 1


The cookie swap attack is a way of bypassing the requirement that a currently logged in user (Alice) must provide their current password prior to changing to a new password.

If I steal a session cookie, but don't know the password, I can't reset the password and my access is limited to this single session until the user logs out and invalidates the coookie.

If the site is vulnerable to a cookie swap, an attacker would exploit this by creating her own account (Eve), and going to the page to reset their password. Eve types on her known password and gets redirected to a page prompting her to enter a new password.

At this point she swaps her cookie for Alice's cookie. Now the server gets a request with a valid key in the URL or POST indicating this is a valid password change request, but the cookie sent with that request was Alice's.

Thus you set Alice's password to whatever Eve wants.

  • I don't remember where I first heard this described. It was probably in one of the trainings, but I can't place which. This was just my best recollection. Sorry.
    – Daisetsu
    Oct 7, 2018 at 21:32
  • Just the clarify not the blackhat trainings. I didn't take those.
    – Daisetsu
    Oct 7, 2018 at 21:32
  • I totally understand. I tried googling for it myself. I much prefer summarizing something then including a nice credible source, but I couldn't find any references either. I figured an unsourced description was better than none as most questions that are a few days old don't often get answered in my experience. If you find a source that differed I would be most interested.
    – Daisetsu
    Oct 8, 2018 at 3:43
  • Ok, so I sent an email to the guy running the training. Let's see if he responds.
    – Daisetsu
    Oct 11, 2018 at 3:55

You must log in to answer this question.