3

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting some vulnerabilities like XSS? Is this can be considered as privacy breach? (I think they can get browsing history of the victim, please correct me if am wrong)

.google.com TRUE    /   FALSE   1471942336  PREF    ID=84678a35588b1188:U=9b6b2ee8558b7923:FF=1:LD=en:TM=1408811421:LM=2408870337:GM=1:S=5fOkt0gjybaO4t48
.google.com TRUE    /   FALSE   0   SID DQABBBAAEBAAAZdehBqmKnR-Sp5mfXSGwwDMtHLgyKm09sQBMsaMn0qOcsjn8Ddivbb80BCBbi11Jtg1H3Wy-EvjYH1AneL8aG9frhTl9cZ33Ba2bW3L0ARyQN_Zbvpdvtd3KtEj6p1783XXFbnp-uWFHD9lqBDyvmln7bg1vdeINZm9vu1PmwMr0Do6_X9FQWOL1yLjhhnt5eWTeQMXdKgovm4xRkF9PlFR9KBIqtDMphCFx8bmB7M7oa4z5MXlHlmInAgfdEKGvA3C9euewCH0kFi2D1xpGFfjXmCHeYzsWxFAjtWbsxuSWqqMI2MDErDzMArN160A2Gouxwzpz0r4NKKiWHJwGxBMwomarSEt9Pr5fwEI_dPaX27wSQ
.google.com TRUE    /   FALSE   0   APISID  Py_WwXqgR7fa7RBeY/ASRXSmnMAGWYP-fesUq
.google.com TRUE    /   TRUE    0   SAPISID _FcGfSR_PII9LYQvUa/AdsSewK7WmKEzKGNmc
Improve this question
3
  • 8
    Did you just give us your cookies?
    – BadSkillz
    Commented Feb 17, 2015 at 11:05
  • 3
    @BadSkillz: don't worry, these are Google's, they store the important stuff (for example, HSID, NID and SSID) as HTTP-only. So OP is safe even if these are his real cookies =D
    – Mints97
    Commented Feb 17, 2015 at 14:53
  • @BadSkillz, haha, I changed the cookie values ;)
    – aMa
    Commented Feb 18, 2015 at 3:24

2 Answers 2

Reset to default
4

Well, even if Google was vulnerable to XSS, this still wouldn't be a breach.

Why? Because of the HTTPOnly flag. It is the big reason for XSS's downfall.

You can say there are two kinds of cookies:

  1. those that your browser gets when it recieves an HTTP response from a remote server (like google.com). They are in the Set-Cookie part of the response.

  2. cookies set by JavaScript dynamically after you've opened the webpage, which can then be read by your browser.

What's the HTTPOnly flag? It is a flag on a cookie which means that it strictly falls into the first category only, and not the second. I.e. HTTPOnly cookies can be read by the browser only as part of the HTTP response, JavaScript has no access to them.

That is why, when you use document.cookie, be it an XSS scenario or not, you only get the not-HTTPOnly cookies. There is usually nothing important stored in these; all adequate and security-savvy webmasters keep the session cookies as HTTPOnly.

Improve this answer
0

They can log in pretending to be you, your cookie is basically the token that the server gave you so that you can stay logged. So that means accessing all the google services logged in with your account. If those are your real cookie values, you should log out from you google account as soon as possible..

EDIT: I didn't notice you said you dumped the cookies via javascript and not from the raw request, my bad

Improve this answer
1
  • are you sure about that? I would expect google to make those cookies httpOnly. The only cookies not httpOnly seem to be the 4 posted once: PREF, SID, APISID, SAPISID. google.com additionally has (httpOnly) OGPC, SNID, HSID, SSID, NID, PREF, and accounts.google.com (also httpOnly) has GoogleAccountsLocale_session, GALX, ACCOUNT_CHOOSER, GAPS, LSID. I would assume that the authentication tokens are stored in the later. It would still be interesting to know what is stored in the 4 not httpOnly cookies.
    – tim
    Commented Feb 17, 2015 at 14:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .