WASEC: Web Application Security for the everyday software engineer by Alessandro Nadalin
Author:Alessandro Nadalin [Alessandro Nadalin]
Language: eng
Format: epub
Publisher: leanpub.com
Published: 2019-11-25T00:00:00+00:00
Encrypt it or forget it
Cookies contain very sensitive information: if attackers can get a hold of a session ID, they can impersonate users by hijacking their sessions.
Most session hijacking attacks usually happen through a man-in-the-middle who can listen to the unencrypted traffic between the client and server, and steal any information thatâs been exchanged. If a cookie is exchanged via HTTP, then itâs vulnerable to MITM attacks and session hijacking.
To overcome the issue, we can use HTTPS when issuing the cookie and add the Secure flag to it: this instruct browsers to never send this cookie in plain HTTP requests.
Going back to our practical example, we can test this out by navigating to https://wasec.local:7889/?secure=on. The server sets 2 additional cookies, one with the Secure flag and one without:
Download
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.
Digital Forensics and Incident Response - Second Edition by Gerard Johansen(1468)
Network Security Strategies by Aditya Mukherjee(1370)
Modern Cryptography for Cybersecurity Professionals by Lisa Bock(1339)
Practical Cybersecurity Architecture by Diana Kelley Ed Moyle(1330)
Web Penetration Testing with Kali Linux - Third Edition by Gilberto Nájera-Gutiérrez(785)
Web Application Obfuscation by Mario Heiderich & Eduardo Alberto Vela Nava & Gareth Heyes & David Lindsay(584)
Cybersecurity - Attack and Defense Strategies by Erdal Ozkaya & Yuri Diogenes(581)
GCIH GIAC Certified Incident Handler All-in-One Exam Guide by Nick Mitropoulos(471)
Kali Linux Penetration Testing Bible by Gus Khawaja(428)
Cybercrime Investigations by John Bandler(412)
The Hardware Hacking Handbook by Colin O'Flynn(391)
Computer Hacking Forensic Investigator Exam Workbook: 500+ Questions & Answers for ECCouncil 312-49: Updated 2020 by Aries+ Centre(357)
Kali Linux: Testing Your Network: How to Test Infrastructure Security with Security Testing and Penetration Testing by Eltrinos Frank(352)
The Big User-Friendly Cyber Security Gaint - Palo Alto Networks: An Ultimate Guide To Secure Your Cloud And On-Premise Networks by Purackal Rachel Sebastian(324)
Security in Computing, 5e by Charles P. Pfleeger & Shari Lawrence Pfleeger & Jonathan Margulies(322)
Penetration Testing and Reverse Engineering: Intrusion Detection Systems and e-Commerce Websites by Rob Kowalski(316)
8 Steps to Better Security by Crawley Kim;(311)
Security, Privacy and User Interaction by Unknown(287)
Cybersecurity: A Self-Teaching Introduction by C.P. Gupta & K.K. Goyal(279)
