2202c Web Security: Secure Cookie Flag

problem:

  • some hrefs are hardcoded referencing the host, like https://glocken.hacking-lab.com/12001/cookie_case2/cookie2/controller?action=profile
  • some hrefs are formed like controller?action=showpage&page=contact
  • the second one is actually the better choice, as long as the whole site is only accessible via https (because the host is not hardcoded)
  • if the page is available over http as well, these hrefs are leaking the cookies

attack:

  • login on https://glocken.hacking-lab.com/12001/cookie_case2/cookie2/
  • start wireshark
  • set filter ip.dst == 192.168.200.203 && tcp.port == 80 && http.cookie contains BCookie
  • extract the cookie from the requests

mitigation:

  • only allow access to the whole page via https
  • set the cookie as secure (so that it is only send in https context)