Cookie Manipulation

Cookie Manipulation

Because the HTTP protocol is stateless, there's no way a web server can automatically know that two requests are from the same user. For this reason, cookies were invented. When a web site includes a cookie (an arbitrary string) in a HTTP response, the browser automatically sends the cookie back to the browser on the next request. Web sites can use the cookie to save session state. Gruyere uses cookies to remember the identity of the logged in user. Since the cookie is stored on the client side, it's vulnerable to manipulation. Gruyere protects the cookies from manipulation by adding a hash to it. Despite the fact that this hash isn't very good protection, you don't need to break the hash to execute an attack. The first thing I had to do when taking on this exercise is find out where Gruyere issues cookies. After searching through the code I found that one is issued after logging in. After Parsing through the cookie I found how the cookie is set up and began to think of a way to exploit this. I found the exploit after testing the create user functions. This exercise made me look at using one section of the site to set up the exploit before moving to another page to exploit it.