XSS for stealing cookies … not anymore?

Question

The other day I found a XSS vulnerability in a website that a friend told me to Pentest. It was a page from a school that he's managing, so the important thing here is the login credentials == COOKIES.

In this testing, I found that the cookies were HTTP Only, so I tested with a alert(document.cookie) = The alert was blank.

I knew that the cookie was userSession and the value was 019845547 but I couldn't get it with XSS or JavaScript injection. I knew this information with the Developer Tools in Google Chrome.

I read that HTTP Only cookies cannot be accessed by JavaScript for security reasons and that's great!

But that means that XSS is not for cookie stealing anymore?

Or maybe I'm out of date for new security stuff? Or is there another technique to steal HTTP Only cookies?

Answer 1

Well, the server HAS to set this flag on the cookie, if it doesn't, client side scripts such as javascript snippets in a XSS style attack can access the cookie contents. Also, you might want to look at XST(Cross-Site Tracing) which i believe can bypass this flag and allow stealing cookies in some scenarios. From the wiki page for it:

Tagging a cookie as HttpOnly forbids JavaScript to access it, protecting it from being sent to a third party. However, the TRACE method can be used to bypass this protection and access the cookie even in this scenario. Modern browsers now prevent TRACE requests being made via JavaScript, however, other ways of sending TRACE requests with browsers have been discovered, such as using Java.

More about this at: https://www.owasp.org/index.php/Cross_Site_Tracing

Hope this helps.

Answer 2

But that means that XSS is not for cookie stealing anymore?

In short, no, XSS isn't used to steal cookies when this flag is set.

The longer answer is that modern browsers support the HttpOnly flag on cookies. This flag can be set when the server sends a Set-Cookie header to the browser to keep document.cookie from getting the contents of cookies. It is a mitigation technique to the larger problem of XSS. As far as I am aware, with up-to-date browsers and current versions Flash, Java, and other plugins, there's no way to bypass this flag.

However, because you have XSS, there are other ways to get access to credentials without getting access to the cookies.

Answer 3

If implemented correctly, HttpOnly prevents an attacker stealing the cookie.

However HttpOnly feature can be bypassed in certain versions of some browsers and web servers.

Take a look:

https://lwn.net/Articles/646891/

https://www.youtube.com/watch?v=jrKOdWPZtAg

https://bugzilla.redhat.com/show_bug.cgi?id=1222923

So in summary HttpOnly makes things harder for an attacker, but does not stop a experienced hacker/pentester.

Answer 4

When HTTP Only flag is set tot true on the server side then there is no other way to steal the cookie using XSS.In modern web browsers like Chrome there is no way to see the cookies using xss because the xss filters are enabled by default.

If it is not enabled on the browser then there is also a way to enable the XSS filter in the browser from a server side response header called X-XSS-Protection you can veify this for this header

But that means that XSS is not for cookie stealing anymore?

We can't able to steal the cookie using client side scripting anymore when this flag is enabled.