HTTP protocol (7) CookieWeb Security Test-cache of XSSHTTP Protocol

Cookie is a very important thing in the HTTP protocol. I have read [talk about cookies] written by Fish Li before, and I have learned a lot. Fish's article is too classic. So I don't have much content in this article.

Recently, I plan to write a series of HTTP articles. From the HTTP protocol perspective, I will talk about my understanding of cookies.

 

Reading directory

1. Cookie
2. Cookie category
3. Cookie
4. Use and disable cookies
5. Fiddler
6. Principle of automatic website login
7. Intercept cookies and impersonate others
8. Differences between Cookie and File Cache
9. Cookie leakage privacy
10. P3P Protocol

 

Cookie

Please refer to the [Cookie] written by Fish Li]

 

Cookie category

Cookies can be roughly divided into two categories: session cookies and persistent cookies.

Session cookie: a temporary cookie that records the settings and preferences of users when accessing the site. When the browser is closed, the session cookie is deleted.

Persistent cookie: stored on the hard disk. (no matter the browser exits or the computer restarts, the persistent cookie exists .)

 

Cookie

Cookie is stored on the hard disk. The cookie stored in IE is different from that stored in Firefox. Different operating systems may store different cookies.

Different browsers store cookies in their independent spaces and do not interfere with each other.

Take Windows 7 and IE8 as an example. The cookie contains C: \ Users \ xiaoj \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files.

Note: cache files and cookie files exist together in this directory.

You can also find it. Open IE and click the Setting button under Tools> Internet Options> General Tab> Browsing history. In the displayed dialog box, click View files.

 

Different websites have different cookie files.

 

Use and disable cookies

IE: Tools> Internet Options> privacy

 

Fiddler

The browser sends the cookie to the Web server through "Cookie: header" in the HTTP Request.

The Web server sends the Cookie to the browser through "Set-cookie: header" in HTTP Response.

Using Fiddler, you can clearly see that the cookie is passed in HTTP. In the Fiddler tool, you can clearly see the Cookie in Http Request and the cookie in Http Response.

Instance: Start Fiddler and open a browser to access some shopping websites.

 

 

Principle of automatic website login

The following example shows how cookies are transmitted.

As you know, the blog can be automatically logged in. For example, what is the principle?

If I have already entered the user name and password on the login page, select Save Password and log on.

(At this time, you actually saved the login cookie on your machine. If you don't believe it, you can go to your computer to find the cookie in the blog garden as described in the previous section)

The next visit to the blog is as follows.

1. Open IE and enter www.cnblogs.com.

2. IE first searches for the cookie about cnblogs.com in the hard disk, then puts the cookie in the HTTP Request, and then sends the Request to the Web server.

3. The Web server returns to the blog homepage (you will see that you have logged on ).

 

Intercept cookies and impersonate others

Through the example above, we can see that cookie is very important. To identify whether a user is logged on, it is through cookie. If someone else's cookie is intercepted, can someone else assume another person's identity to log in? Of course, this is a hacker technology called Cookie spoofing.

Cookie spoofing does not need to know the user name and password. You can log on directly and use someone else's account to do bad things.

I know there are two ways to intercept others' cookies,

1. Attackers can use XSS to obtain others' cookies. For details, refer to [XSS for Web Security Testing].

2. Find a way to obtain the cookie files stored on others' computers (this is difficult)

 

After obtaining the cookie, you can pretend to be someone else's identity. I will not demonstrate this process.

Differences between Cookie and File Cache

Many may confuse cookies and file caches. These two are completely different. The only difference may be that both of them exist on the hard disk and exist in the same folder.

For more information about HTTP cache, see [HTTP protocol cache]

In IE, we can choose to delete cookies and cached files respectively.

 

 

Cookie leakage privacy

At the 2013 gala on CCTV in 315, many illegal companies used cookies to track and collect users' personal information and sell it to online advertisers, forming a gray industry chain for stealing user information. To achieve accurate advertising. Seriously interfering with users' normal network applications and infringing personal privacy and interests.

I often find on the portal that the ad space shows the items I have consumed on the e-commerce website. This is why my cookie is leaked.

 

Currently, Cookie legislation has been implemented in Europe. If a website needs to save a user's cookie, a dialog box must pop up and the user must confirm before saving the Cookie.

 

P3P Protocol

From the above point of view, Cookie is a relatively easy to leak user privacy and danger. Is there a way to protect the privacy of individual users? That is, the P3P protocol.

P3P is a standard called the Platform for Privacy Preferences. It can protect the online Privacy and enable Internet surfers to choose, whether the personal information is collected and used by a third party. If a site does not comply with the P3P standard, Cookies related to it will be automatically rejected, and P3P can automatically detect multiple cookie embedding methods. P3p is developed by the Global Information alliance.