How to intercept cookies files. Methods of stealing cookies files. Physical access to data

Have you ever thought about how to personalize visitors on some Web nodes? This can be expressed, for example, in memorizing the contents of the "trolley" (if this node is intended for sale of goods) or in the method of filling the fields of some form. In the HTTP protocol underlying the functioning of the World Wide Web, there are no means that allow you to track events from one visit to the node to another, so a special addition was developed for the possibility of storing such "states". This mechanism described in the RFC 2109 document provides insertion into the transmitted queries and responses of HTTP special cookies data that allows WEB nodes to track their visitors.

Cookie data can be memorized for communication session time ( pER SESSION.), remaining in RAM during one session and removing when closing the browser, or even after the specified period of time expires. In other cases, they are permanent ( persistent.), remaining on the user's hard disk as a text file. Usually they are stored in the Cookies catalog (% WINDIR% \\ Cookies - in Win9x and% UserProfile% \\ Cookies - in NT / 2000). It is not difficult to guess that after capturing the cookie files in the Internet, the hacker can produce itself for the user of this computer, or collect important information contained in these files. After reading the following sections, you will understand how easy it is to do.

Interception of cookies files

The most direct way is to intercept cookies when transmitting them over the network. The intercepted data can then be used when entering the appropriate server. Such a task can be solved using any package interception utility, but one of the best is the Nikula Lawrence program ( Laurentiu Nicula.) SpyNet / Peepnet. SpyNet includes two utilities that work in the complex. Program Capturenet. Performs the capture of the package itself and saves it on the disk, and the PEEPNet utility opens this file and converts it to a readable format. The following example is a fragment of the Restored PEEPNet Communication Session program during which the cookie file is used to authenticate and control access to the viewed pages (to save anonymity the names changed).

Get http://www.victim.net/images/logo.gif http / 1.0 accept: * / * referrer: http://www.victim.net/ host: www.victim.net cookie: jrunsessionid \u003d 96114024278141622; Cuid \u003d Torpm! zxtfrlrlpwtvfiseblahblah

The example shows a Cookie fragment placed in an HTTP request to the server. The most important field is cuid \u003d.which sets a unique identifier used when authenticating the user on a node www.victim.net. Suppose that after that the hacker visited the Victim.net node, received its own identifier and cookie (it is assumed that the node places cookie data not in virtual memory, but writes them on the hard disk). Then a hacker can open its own cookie file and replace the Cuid \u003d field identifier in it, taking it from the intercepted package. In this case, when entering the Victim.Net server, it will be perceived as a user whose cookies have been intercepted.

Program's ability Peepnet Play the entire session or its fragment makes it much easier to implement the attacks of this type. Use the button Go Get IT! You can re-extract the pages that were viewed by the user using its Cookie data intercepted by the CaptureNet program. In the PEEPNET utility dialog box, you can see information about someone accomplished orders. At the same time, cookie data was used for authentication, intercepted by the CaptureNet program. Pay attention to the frame located in the lower right corner of the dialog box with the communication session data, and on the string that follows the Cookie line. These cookies used in authentication.

This is a rather clever trick. In addition, utility Capturenet. It can provide a full traffic record in decrypted form, which is almost equivalent to the possibilities of professional class utilities, such as Network Associates, Inc. company Sniffer Pro However utility SpyNet. Even better - it can be free!

Countermeasures

The nodes in which cookies are used to authenticate and storing important identification data are used. One of the tools that help in ensuring protection is the KookaBurra Software Cookie Cookie program, which can be found on the Web site http://www.kburra.com/cpal.html. This software product can be configured so that warning messages are generated for the WEB-node attempts to use the cookie mechanism. At the same time, you can "look behind the scenes" and decide whether to allow these actions. Internet Explorer has a built-in cookie support mechanism. To activate it, start the Internet Panel Options on the Security tab, go to the Security tab, select the Internet Zone element, set the Custom Level mode and for constant and temporary cookies. Set the switch to Prompt. Setting the use of cookies in the Netscape browser is performed using the command. Edit\u003e Preferences\u003e Advanced And setting the WARN ME BEFORE ACCEPTING A COOKIE or DISABLE COOKIES (Fig. 16.3). Taking the cookie file, you need to check whether it was written to the disk, and lend whether the Web node collects information about users.

Visiting a node on which cookies serve to authenticate, you need to make sure that the initially reported name and password are encrypted at least using the SSL protocol. Then this information will appear in the PEEPNet program at least in the form of a simple text.

The authors would prefer to completely abandon cookies if many often visited Web nodes did not require this mode. For example, Microsoft's Hotmail service has a cookie for registration worldwide. Since this service in the authentication process involves several different servers, then adding them to the zone of reliable nodes is not so simple (this process is described in the section "Reasonable use of security zones: a general solution to the problem of ActiveX elements"). In this case, the designation * .hotmail.com will help. Cookies are far from the perfect solution to the problem of incompleteness of the HTML protocol, however, alternative approaches appear to be even worse (for example, adding an identifier URL address that can be stored on Proxy servers). Until the idea appears better, the only output remains control over cookies using the methods listed above.

Capture cookies via URL

Imagine something terrible: Internet Explorer users click on specially designed hyperlinks and become potential victims, risking that their cookies will be intercepted. Bennet Hazelton ( Bennett Haselton.) and Jamie McCarthy ( Jamie McCarthy.) From the teenager organization PeaceFire, steady of freedom of communication via the Internet, published a scenario that embodies this idea to life. This script extracts cookies from a client computer if its user clicks on the link contained on this page. As a result, the contents of the cookie file becomes available for Web site operators.

This feature can be used in non-departious purposes by implementing the IFRAME descriptors to the HTML code of the Web page, the email in HTML format or messages from the newsgroup. In the following example, the proposed security counselor Richard M. Smith demonstrates the possibility of using the IFRAME descriptors together with the utility developed by Peacefire.