In this part of the Secfox series, we will be discussing about the addons that can help us during the app security assessments which involves cookie analysis and manipulation.
These addons can be of huge help when we perform the type of tests mentioned below.
- Cookie Prediction
- Session Fixation
- Cookie Persistence/Expiration
- Broken Session Management
Traditional Method
We use a proxy interceptor like Paros/Burp/WebScarab to trap the HTTP requests and modify the values during its transit. For this to happen, we need to setup a proxy and ensure that it listens to the browser traffic. An additional step is required if the application uses an SSL connection, i.e. to store the Proxy’s forged certificate in the browser. The intercepted request enables us to add new cookies or modify the existing ones. We can also check when exactly are the cookie values issued and whether it is getting flushed upon session expiration.
Usage of Addons
We have various addons for firefox which makes the tasks mentioned above easier. Certain addons allow to view the cookies stored in the browser and others allows us to edit it. The advantage – we don’t need any proxy to do this job, we can view/edit from the browser itself.
1. View Cookies
This addon adds a tab in the ‘Page Info’ box available on the Firefox context menu.
View Cookies Addon
Download Link: 
2. Add N Edit Cookies
This addon integrates a Cookie Editor to firefox. This also allows us to edit the attributes of the cookie.
Add n Edit Cookies Addon
Download Link:
Read the rest of this entry »
