UGN Security Forums UGN Security: Underground General How much fun can u have with hijacked cookies?

You hear people talk about deleting your cookies
for advertisement,security,etc? What can one do with someone elses cookies? Would someone actually waste their time to decipher cookies? I know that they store passwords for sites that require them but how?

Cookies contain different data about sessions and login information depending on the site, store information about your account when you last visited and have expiration dates in them. It depends on where the cookies are from and how they're implemented. Some are plain text everything in it is, passwords and all. Nowadays cookies use encryption for larger sites like msn or yahoo. Different cookies do different things, store information about your account and have expiration dates in them. Modifying them can give you access to things you wouldnt have normally. Look up 'cookie poisoning' on google you will learn alot about it.

for windows cookies are stored in C:\WINDOWS\Cookies\ for 9x or C:\Documents and Setting\(username)\Cookies\ in XP

Even linux systems use cookies and are vulnerable even though the way they use them is different, instead of individual files mozilla uses one file called cookies.txt (netscape is probably the same dunno about konquerer or the others).

This still ranks in the top 10 types of vulnerabilites.


Here's some links:

http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci861584,00.html

http://www.cgisecurity.com/lib/CookiePoisoningByline.pdf