Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here.
While I do not like to make these type of posts I cannot find anything about this type of attack. Google "cross" yields that it might be session fixation? But, I'm not sure.
The cookie swap attack is a way of bypassing the requirement that a currently logged in user (Alice) must provide their current password prior to changing to a new password.
If I steal a session cookie, but don't know the password, I can't reset the password and my access is limited to this single session until the user logs out and invalidates the coookie.
If the site is vulnerable to a cookie swap, an attacker would exploit this by creating her own account (Eve), and going to the page to reset their password. Eve types on her known password and gets redirected to a page prompting her to enter a new password.
At this point she swaps her cookie for Alice's cookie. Now the server gets a request with a valid key in the URL or POST indicating this is a valid password change request, but the cookie sent with that request was Alice's.
Thus you set Alice's password to whatever Eve wants.
