Re: Re: Cookie Security

Hi Audrius,

XSS would definatley leave the suggested method wide open.
Although, you could say that about any method...
With XSS available to an attacker, whatever means I use to manage the session will be weak. even over https. no?


Your suggestion of returning a new SessionID for each request seems reasonable, in fact it's pretty much what I suggested towards the end of my post.
Even so, the token could still be sniffed and used by another client up until the legitimate user requests a page again.
In some cases, this may not happen due to an attackers actions. For example on a switched network, the very same method used to sniff the SessionID could be used to stop any further request from the "real" client... session stolen.
At the very least, this method would leave the application open to denial of service if an attacker can sniff session ID's.


Using client information (Screen res, color depth, flash e.tc.) to help confirm session seems weak. This info is obtained from the client isn't it?
Nothing to stop this being sniffed and spoofed also.


Are there any methods you know of that are able to work around these issues?
I can't imagine any session system will be safe with XSS available to an attacker, so perhaps the best thing to do is go ahead with the suggested method, and take extra care around XSS holes.


I know SSL is the "real" solution, but I wondered if anyone has attempted to secure this common system at an application level. perhaps not. if so thats fine.

Any input you can give would be great.

Thanks.

EL

Relevant Pages

  • Re: just an idea for packet protocol using ECB
    ... >> packets may be lost. ... the system would never shutdown if attackers kept ... The damage an attacker ... So each file transmission gets a session number. ...
    (sci.crypt)
  • CommuniGatePro 4.0.6 [EXPLOIT]
    ... Session ID used in CGP WebMail to track sessions is ... Attacker can send HTML message with img src ... hijack current user session - read mailbox, ...
    (Bugtraq)
  • Re: [Full-disclosure] XSS in Sambar Server version 6.2
    ... - obtain the session management mechanism ... > somebody with priviliged rights could have effected within the application. ... the XSS is a very low level vulnerability. ... > which logs the users cookie then this becomes more of an issue. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] on xss and its technical merit
    ... I can think of pretty much 3 examples of XSS (granted without ... In this case the vulnerability is not XSS the vulnerability is either that ... the list will no doubt ask me for a secure session management schema but I ... Even if nothing valuable is stored by the session management, ...
    (Full-Disclosure)
  • RE: Proof of Concept Tool on Web Application Security
    ... Links to the presentation, the "iDefense Session ... >Inspect, Spike Proxy etc. ... Web Sleuth than he can perform attacks. ... >This manipulation can also be achieved if an Attacker can put ...
    (Pen-Test)