If you Give a Hacker a Cookie
summary
Demonstrates that a persistent session cookie lacking HttpOnly/SameSite and secure flags lets injected JavaScript read and exfiltrate the cookie (POC uses an alert then sends the value via an image request), with automated evidence from OWASP ZAP flagging SameSite and Secure missing. Contrasts that with OIDC/Oauth/JWTs where short expirations and validation against a JWK public key let an API gateway enforce roles and revoke risk without large session stores.
AI-written summary · about
chapters (19)
- 0:00Intro
- 3:29XSS Exploit Stealing Cookies Session Hijacking
- 9:44Related Topics Mitigation & Avoidance
- 11:18If you Give a Hacker a Cookie Then do the following
- 12:17WAM - Web Access Management
- 16:20Open ID Connect (OIDC) Layer on Top of Oauth v2
- 17:34JWT - JSON Web Tokens
- 20:22JWT must be validated with JWK Per Spec
- 20:53Oauth Grant Types For Various types of Clients
- 26:26Testing PKCE with PostMan Better Tool Support When using Oauth
- 27:13Password Grant Type
- 29:46Overview
- 32:15OWASP API Security Top 10 Access Control Issues & Rate Limiting
- 32:58REST API Fronted by API Gateway Policy Enforcement Point
- 33:27RBAC - Function Level Access Control JWT has Roles that are validated by gateway
- 34:19API Gateway - Rate Limiting Policies for Defense in Depth
- 35:21Content Management Solution with Apache Mod OIDC
- 38:12Full Cloud leveraging Built-in Authentication
- 39:57Conclusions
related talks
21mDeath to Cookies
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
49mCookie Security Myths and Misconceptions
48mThe Hacker's Guide to JWT Security
50mSecure Authentication and Session Management
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
27mCookies versus tokens: a paradoxical choice
33mHacking The Front-End