can't steal session ID cookie

Question

can't steal session ID cookie

bachrach44 opened this issue 11 years ago · comments

Ari Elias-Bachrach commented 11 years ago

The ASP.Net_SessionID cookie is httponly. While this is good for security, it's bad for webgoat. It would be nice to be able to demonstrate cookie stealing with the XSS attacks. Let's set it to not be that way initially, and part of the job of fixing webgoat is to change it to be httponly.

Ray · Answer 1 · Sat Mar 02 2013 03:25:06 GMT+0800 (China Standard Time)

Should be working. HttpOnlyCookies is now set to false.

edit: should be now and not not!

Stefan Hutchison · Answer 2 · Sat Mar 02 2013 03:47:16 GMT+0800 (China Standard Time)

HttpOnlyCookies should be false in order to be accessed by javascript and therefore be available for stealing. If HttpOnlyCookies is True, then javascript cannot access it.

EDIT: I think you meant now, instead of not - so nevermind.

Ray · Answer 3 · Sat Mar 02 2013 03:48:38 GMT+0800 (China Standard Time)

Sorry, typo on my part. Should say is NOW set to false.