Session Cookie Theft

intermediateSupporting Technique

Stealing temporary cookies that contain user authentication data stored in the browser during active sessions.

Detailed Overview

Session cookies are small pieces of data stored in the browser that maintain user authentication state. Attackers target these cookies through various methods including XSS attacks, malware, and network interception. Once stolen, these cookies can be replayed to impersonate the legitimate user without knowing their credentials.

Prevention Strategies

01Set HttpOnly flag on session cookies
02Use Secure flag to ensure HTTPS-only transmission
03Implement SameSite cookie attribute
04Set appropriate cookie expiration times
05Regenerate session IDs after authentication

Tools

Common software used to explore or defend against this technique.

Browser DevTools
curl
Python requests
Burp Suite

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Inspect Set-Cookie flags with curl

bash

Check whether your own app sets HttpOnly, Secure, and SameSite on login.

#!/usr/bin/env bash
# Point at YOUR staging app only
URL="https://staging.example.com/login"
curl -sI -X POST "$URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "user=demo&pass=demo" | grep -i set-cookie

Cookie flag checklist in Python

python

Parse response headers and report missing security flags.

import requests

def cookie_flag_report(url: str) -> list[dict]:
    r = requests.get(url, timeout=10)
    report = []
    for c in r.cookies:
        # http.cookiejar Cookie attributes
        report.append({
            "name": c.name,
            "secure": bool(c.secure),
            "httponly": "HttpOnly" in (c._rest or {}),
        })
    return report

print(cookie_flag_report("https://staging.example.com"))