stealing web browser cookies
play

Stealing Web Browser Cookies ben-holland.com Whats a cookie? Web - PowerPoint PPT Presentation

Jan 16, 2023 •633 likes •712 views

Stealing Web Browser Cookies ben-holland.com Whats a cookie? Web 2.0 Cookies provide state Examples: Items in shopping cart AuthenFcaFon! Cookies Passwords! Username + Password = Cookie If I know your authenFcaFon

  1. Stealing Web Browser Cookies ben-holland.com

  2. What’s a cookie?

  3. Web 2.0 – Cookies provide state Examples: • Items in shopping cart • AuthenFcaFon!

  4. Cookies ≥ Passwords! • Username + Password = Cookie • If I know your authenFcaFon cookie value I don’t need your password! • SomeFmes cookies don’t expire for a really long Fme…

  5. How can I get your cookies? • Packet sniffing (wiretapping) – Wired networks – Wireless networks • (IASTATE vs eduroam) – HTTP vs. HTTPS – hUps://www.cookiecadger.com/ – hUps://github.com/benjholla/tssk

  6. How can I get your cookies? • XSS (Cross Site ScripFng) AUacks – How about you just send me your cookies… – HTTP Only Flag

  7. How can I get your cookies? • Client Side AUacks – Browsers store cookies in a file… – hUps://github.com/benjholla/CookieMonster

Recommend

Retroactively estimating system clock skew from stored web browser cookies Contents 1. Why? 2.

Retroactively estimating system clock skew from stored web browser cookies Contents 1. Why? 2.

Retroactively estimating system clock skew from stored web browser cookies Contents 1. Why? 2. Mechanism for deriving skew from cookies 3. Data & data processing 4. Demonstration of algorithm Time. It matters. John is a suspect in a

470 views • 15 slides
COOKIES How can apps maintain user state? Cookies! small bits of data downloaded to your

COOKIES How can apps maintain user state? Cookies! small bits of data downloaded to your

CS 498RK FALL 2017 COOKIES How can apps maintain user state? Cookies! small bits of data downloaded to your computer so that a site can remember you and what you did on subsequent visits Browser Server first request http:/

475 views • 23 slides
Browser and Network request Browser website CS 4803 reply Network OS Computer and Network

Browser and Network request Browser website CS 4803 reply Network OS Computer and Network

Browser and Network request Browser website CS 4803 reply Network OS Computer and Network Security Hardware Alexandra (Sasha) Boldyreva Browser sends requests May reveal private information (in forms, cookies) Web security.

517 views • 7 slides
Cookies Cookies HTTP is stateless To "remember" a user we use cookies In a

Cookies Cookies HTTP is stateless To "remember" a user we use cookies In a

Cookies Cookies HTTP is stateless To "remember" a user we use cookies In a response header, we can give the user information as a cookie All subsequent requests will contain these cookies in a header Since cookies work

475 views • 10 slides
Cookie Protocol Server sets cookies in response header: Set-Cookie: session=0x4137f;

Cookie Protocol Server sets cookies in response header: Set-Cookie: session=0x4137f;

Cookie Protocol Server sets cookies in response header: Set-Cookie: session=0x4137f; Expires=Wed, 09 Jun 2012 10:18:14 GMT Name Value Expiration Time Browser returns cookies in headers of later requests: Cookie: session=0x4137fd6a CS

701 views • 4 slides
CSRF Recall: Session using Cookies Browser Server POST/login.cgi r o a t c i n t e h

CSRF Recall: Session using Cookies Browser Server POST/login.cgi r o a t c i n t e h

CSRF Recall: Session using Cookies Browser Server POST/login.cgi r o a t c i n t e h t u a e : i o k o c t - e S G E T C o o k i e : a u t h e n t i c a t o r e s n o p s e r How it

363 views • 17 slides
Graphing Crumbling Cookies AdKDD 2019 Matt Malloy, Jon Koller and Aaron Cahn What is a device

Graphing Crumbling Cookies AdKDD 2019 Matt Malloy, Jon Koller and Aaron Cahn What is a device

Graphing Crumbling Cookies AdKDD 2019 Matt Malloy, Jon Koller and Aaron Cahn What is a device graph? a dataset that organizes digital identifiers that we create as we use the internet identifiers (IDs): browser cookies or advertising

284 views • 11 slides
Browser forensics: Adblocker extensions Willem Rens (UvA MSc SNE student) Supervisor: Johannes

Browser forensics: Adblocker extensions Willem Rens (UvA MSc SNE student) Supervisor: Johannes

Browser forensics: Adblocker extensions Willem Rens (UvA MSc SNE student) Supervisor: Johannes de Vries (Fox-IT) Why traditional browser forensics may not work Cleared Cookies Cache History Sometimes recoverable, Jeon et

786 views • 44 slides
Cookies and Sessions Thierry Security assumptions You have absolutely no control on the client

Cookies and Sessions Thierry Security assumptions You have absolutely no control on the client

Cookies and Sessions Thierry Security assumptions You have absolutely no control on the client Client Side Server Side Web Server Database Web Browser Cookies The big picture key/value pairs data Client Side Server Side HTTP request

783 views • 13 slides
Browser Storage Andrew Sutherland Mozilla DOM Team Current Cross-Browser Storage APIs

Browser Storage Andrew Sutherland Mozilla DOM Team Current Cross-Browser Storage APIs

Browser Storage Andrew Sutherland Mozilla DOM Team Current Cross-Browser Storage APIs Cookies: Synchronous, Strings, Hard Storage Cap LocalStorage: Synchronous, Strings, Hard Storage Cap IndexedDB: Asynchronous, Structured

481 views • 7 slides
A bug bounty tale: Chrome, stylesheets, cookies, and AES Pepe Vila Software Seminar Series (S3)

A bug bounty tale: Chrome, stylesheets, cookies, and AES Pepe Vila Software Seminar Series (S3)

A bug bounty tale: Chrome, stylesheets, cookies, and AES Pepe Vila Software Seminar Series (S3) Thursday, December 14, 2017 file URI scheme Q: Who opens downloaded HTML or PDF files with the file://host/path browser? In a HTTP(s) scheme the

665 views • 27 slides
Browser Security Part 2 Recap XSS 3 different types Common aim/theme Steal user

Browser Security Part 2 Recap XSS 3 different types Common aim/theme Steal user

Browser Security Part 2 Recap XSS 3 different types Common aim/theme Steal user credentials (session ID, cookies, etc.) CSRF Cross-Site Request Forgery is an attack that forces an end user to execute unwanted actions on a

428 views • 23 slides
PEXit PRIVACY and COOKIES POLICY This PRIVACY and COOKIES POLICY conveys how PEXit collects, uses,

PEXit PRIVACY and COOKIES POLICY This PRIVACY and COOKIES POLICY conveys how PEXit collects, uses,

PEXit PRIVACY and COOKIES POLICY This PRIVACY and COOKIES POLICY conveys how PEXit collects, uses, shares, stores and manages your information. We have built our business based on (a) our integrity, (b) our sincere effort to meet your

206 views • 3 slides
WORK STEALING SCHEDULER 2 6/16/2010 Work Stealing Scheduler

WORK STEALING SCHEDULER 2 6/16/2010 Work Stealing Scheduler

1 6/16/2010 Work Stealing Scheduler WORK STEALING SCHEDULER 2 6/16/2010 Work Stealing Scheduler Announcements Text books Assignment 1 Assignment

476 views • 32 slides
IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th edition and online Perl Chapter of textbook) Cookies Example 1 JavaScript: Using Cookies Cookie Data stored on _____________ to maintain

263 views • 9 slides
Should Internet Cookies Be Further Regulated by the Government? Research Presentation by

Should Internet Cookies Be Further Regulated by the Government? Research Presentation by

Should Internet Cookies Be Further Regulated by the Government? Research Presentation by Kaitlin Burdick Overview Background Arguments For the Regulation of Cookies Arguments Against the Regulation of Cookies Conclusion

319 views • 13 slides
SY306 Web and Databases for Cyber Operations Slide Set # 8: Cookies and Web tracking Some from

SY306 Web and Databases for Cyber Operations Slide Set # 8: Cookies and Web tracking Some from

SY306 Web and Databases for Cyber Operations Slide Set # 8: Cookies and Web tracking Some from https://www.httpwatch.com/httpgallery/cookies/ and https://www.httpwatch.com/httpgallery/headers/ HTTP client-server interaction review 1 Cookies

181 views • 4 slides
Cookies & Milk ...Soda? Matthew Lau Professor Imielinski March 28, 2017 Data 101 WALMART

Cookies & Milk ...Soda? Matthew Lau Professor Imielinski March 28, 2017 Data 101 WALMART

EAT COOKIES Cookies & Milk ...Soda? Matthew Lau Professor Imielinski March 28, 2017 Data 101 WALMART Assignment You might think Cookies and Milk are bought together... You would be wrong. There are no specific associations between

660 views • 9 slides
Chapter 12 Stoichiometry 1 Section 12.1 The Arithmetic of Equations 2 Cookies and

Chapter 12 Stoichiometry 1 Section 12.1 The Arithmetic of Equations 2 Cookies and

Chapter 12 Stoichiometry 1 Section 12.1 The Arithmetic of Equations 2 Cookies and ChemistryHuh!?!? Just like chocolate chip cookies have recipes, chemists have recipes as well Instead of calling them recipes, we call them reaction

677 views • 41 slides
IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 -4 th edition and online Perl Chapter of textbook) JavaScript: Using Cookies Cookie Data stored on _____________ to maintain information about client

342 views • 8 slides
Cookies: JavaScript and Perl (Some from Chapter 11.9 and online Perl Chapter of textbook) 11.9

Cookies: JavaScript and Perl (Some from Chapter 11.9 and online Perl Chapter of textbook) 11.9

IT350 Web and Internet Programming Cookies: JavaScript and Perl (Some from Chapter 11.9 and online Perl Chapter of textbook) 11.9 JavaScript: Using Cookies Cookie Data stored on _____________ to maintain information about client during

765 views • 6 slides
I see a cookie banner Is it even legal? Nataliia Bielova and Cristiana Santos joint work with

I see a cookie banner Is it even legal? Nataliia Bielova and Cristiana Santos joint work with

This presentation contains cookies that will be stored in your memory to make sure you remember this presentation. By attending this presentation, you agree to the placement of these cookies. To learn more, read our Privacy Policy. I see a

512 views • 23 slides
SY306 Web and Databases for Cyber Operations Set #10: Cookies in JavaScript and Python

SY306 Web and Databases for Cyber Operations Set #10: Cookies in JavaScript and Python

SY306 Web and Databases for Cyber Operations Set #10: Cookies in JavaScript and Python https://www.w3schools.com/js/js_cookies.asp https://docs.python.org/3/library/http.cookies.html

138 views • 9 slides
How to be a paranoid or just think like one 1 2 Leaking information Stealing 26.5 million

How to be a paranoid or just think like one 1 2 Leaking information Stealing 26.5 million

Pro rotection a and S d Securi rity How to be a paranoid or just think like one 1 2 Leaking information Stealing 26.5 million veteran s data Data on laptop stolen from employee s home (5/06) Veterans names Social Security

580 views • 30 slides

More recommend