0

If a user has already logged in, and then the site sets a non HttpOnly cookie, then it seems possible to trick the user into doing something that would lead to the cookie being stolen.

If the cookie expires after one minute, it seems like there'd only be one minute during which the user could be tricked into doing something that would lead to the cookie being stolen.

My question is whether it's possible to trick the user into logging in to the site and stealing the cookie immediately after the non HttpOnly cookie is set.

6
  • I don't understand your attack scenario. Who wants to steal the cookie - presumably some attacker neither associated with the user nor with the site? What access has the attacker - just its own web site, being man in the middle on an unprotected connection, ... ? But since you've tagged XSS I assume that you mean an XSS attack - which would require the site to be vulnerable to XSS in the first place, i.e. XSS is not possible without existing vulnerability. Apr 11 at 17:12
  • The attacker is neither associated with the user nor with the site, though they know the url to the site where the user would log in and we can assume they know the user's email. I'm wondering if it's possible for the attacker to somehow send the user an email with a malicious link that could somehow trick the user into logging in, and then steal the non HttpOnly cookie.
    – ETLJ
    Apr 11 at 17:17
  • 1
    If a) the site is vulnerable to XSS and b) the attacker knows the email of the user, then the attacker could send the email to the user with a link which would steal the cookie. Details depend on the exact vulnerability. If either a) or b) are not given then the attacker can't do this. Apr 11 at 17:19
  • Sending an email to the user with a link which would steal the cookie would have to happen within one minute of the user logging in, as the cookie expires after one minute. If that were the attacker's approach, they'd somehow have to know when the user logged in, and get the user to click on the malicious email link within one minute, which seems difficult. So my question is whether it's possible for them to trick the user into logging in and then immediately stealing the cookie afterwards, that way the attacker doesn't have to know when exactly the user logged in.
    – ETLJ
    Apr 11 at 17:23
  • 2
    With an XSS vulnerability the attacker does not have to wait for the user to login in before sending the mail. Depending on the vulnerability it might be a stored XSS (i.e. not included in the link but persistent on the site) which gets executed immediately after logging in. But - all of this looks pretty constructed for me. It is like you try to write a story and want to check if what you write would be actually feasible. Apr 11 at 17:33

1 Answer 1

1

My question is whether it's possible to trick the user into logging in

One possible way this can be accomplished is with a CSRF attack on the logout functionality. Logout is often not protected from CSRF, so requesting /logout or something similar will logout the current user. If they were actively using the application, they will presumably log right back in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .