Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Problem with Cookie Hijacking Test

Discuss Problem with Cookie Hijacking Test in the Antivirus Protection forum on Dev Shed.
Problem with Cookie Hijacking Test Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
Stop making mediocre tutorials.The best tutorials are video! Camtasia Studio makes it easy to create engaging, buzz-building screen videos at any size, in any popular format. Download the free trial!
  #1  
Old September 24th, 2002, 01:39 PM
yoyo yoyo is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2001
Posts: 77 yoyo User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 53 m 50 sec
Reputation Power: 7
Problem with Cookie Hijacking Test
I store my userid in the cookie. Let's say I login with userid=1. I then open up the cookie file and change userid1 to userid2. If I continue browsing it still uses the original userid 1. If I close and reopen the browser and look at the cookie, the userid section has been removed and I need to relogon to set the cookie, although other cookie variables still exist.

Why is it that I can't change the userid in the cookie? Does it have something to do with that long number after each cookie variable?

Looking for any ideas,
yoyo
Reply With Quote
  #2  
Old September 24th, 2002, 02:00 PM
maytricks's Avatar
maytricks maytricks is offline
Always Spell Chek
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2002
Location: NJ, USA
Posts: 338 maytricks User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 58 m 27 sec
Reputation Power: 6
Please post the code that you use to set the cookie, update the cookie, and/or destroy the cookie. Sounds like you are not using cookie variables correctly.
__________________
Programming is easy. It's the thinking that's hard.

Search the forums before you ask your question.
PHP | MySQL websites. Visit them, read them, cherish them.
Read the posting rules, before you post.
See if your question has been answered already.
Reply With Quote
  #3  
Old September 24th, 2002, 02:12 PM
yoyo yoyo is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2001
Posts: 77 yoyo User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 53 m 50 sec
Reputation Power: 7
To create cookie:

PHP Code:
if ($_POST['submit'])
{
    $user_id = check_pass($_POST['uname'], $_POST['pass']);

    if (isset($user_id))
    {
        $message = 'You are now logged in.';

        if (isset($_POST['rem_me']))
        {
            setcookie ('user_id', $user_id, time()+2592000, '/'); //expire in 30 days
        }
        else
        {
            setcookie ('user_id', $user_id); //expire upon close of browser
        }
        $_COOKIE['user_id'] = $user_id; //I set this only so it gets set for initial page loading.
    }
    else
    {
        $message = 'Invalid login. Please try again.';
    }
} 


To delete cookie:

PHP Code:
if ($_GET['action'] == 'logoff')
{
    $message = 'You have logged out.';
    setcookie ('user_id', '', time()-3600, '/');
    unset($_COOKIE['user_id']);
} 


I never update the userid cookie. Everything is working fine otherwise. Maybe this is a good thing and I don't need to add more security as far as cookie stuff is concerned?
Reply With Quote
  #4  
Old September 24th, 2002, 03:07 PM
maytricks's Avatar
maytricks maytricks is offline
Always Spell Chek
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2002
Location: NJ, USA
Posts: 338 maytricks User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 58 m 27 sec
Reputation Power: 6
Just a few suggestions. First, I dont see any code that resembles what you where talking about, with changing the userid in the cookie. That should be a simple call, just use setcookie() just like you set the cookie, just use the new userid this time.

PHP Code:
// kill old user id.
setcookie ('user_id', '', time()-3600, '/');

// set new userid.
setcookie ('user_id', $user_id, time()+2592000, '/'); 


As for login/logout problems. I would check to see if a cookie is there and then destroy it before creating a new one. This will just ensure that the cookie is fresh. You should also destroy all cookies that you may have stored for use while the user is logged in. Use the same setcookie() idea as mentioned above to expire each one.

PHP Code:
if ($_POST['submit'])
 {
  $user_id = check_pass($_POST['uname'], $_POST['pass']);

   if (isset($user_id))
    {
     $message = 'You are now logged in.';

      if (isset($_POST['rem_me']))
       {
        if (isset($_COOKIE['user_id']))
         {
          setcookie ('user_id', '', time()-3600, '/');
          setcookie ('user_id', $user_id, time()+2592000, '/');
         }
        else
         {
          setcookie ('user_id', $user_id, time()+2592000, '/'); //expire in 30 days
         }
       }
      else
       {
        setcookie ('user_id', '', '', '/');  //expire upon close of browser
       }
    $_COOKIE['user_id'] = $user_id; //I set this only so it gets set for initial page loading.
   }
  else
   {
    $message = 'Invalid login. Please try again.';
   }
 } 


As for destroying the cookie, I don't think you need to unset() the cookie variable after you have expired the cookie. I guess you can, but I still dont think there is a huge need for it.

I personally try to expire and then create a new cookie if I need to refresh the info in it. I would not reccommend just trying to edit the value of the cookie.
Last edited by maytricks : September 24th, 2002 at 03:11 PM.
Reply With Quote
  #5  
Old September 24th, 2002, 03:32 PM
yoyo yoyo is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2001
Posts: 77 yoyo User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 53 m 50 sec
Reputation Power: 7
As far as changing the userid in the cookie, it not anywhere in the code, I'm actually physically opening up the cookie txt file and changing the userid in there, to see if I can "hijack" a different user's id. I haven't had any success, which is a good thing. So I guess maybe everything is fine then.
Reply With Quote
  #6  
Old September 24th, 2002, 03:35 PM
andy81 andy81 is offline
Senior Member
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2002
Posts: 8 andy81 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
the value portion of the cookie will automatically be urlencoded when you send the cookie, and when it is received, it is automatically decoded and assigned to a variable by the same name as the cookie name.

RTFM
Reply With Quote
  #7  
Old September 24th, 2002, 05:21 PM
yoyo yoyo is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2001
Posts: 77 yoyo User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 53 m 50 sec
Reputation Power: 7
What does that have anything to do with the problem? In this case the value is '1'. urlencoding that value will not change the value at all.

If I physically change userid1 to userid2 in the cookie txt file, why is it not taking effect when I reopen the browser? In fact, the entire userid2 section is removed if I check the cookie txt file after reopeing the browser.
Reply With Quote
  #8  
Old September 24th, 2002, 06:02 PM
Dingle Dingle is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2000
Posts: 452 Dingle User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 43 m 12 sec
Reputation Power: 8
it's possible the browser will try to detect manual modification of the cookie file and throw away your changes.

Even if it does, though, i wouldnt rely on it for security.
Reply With Quote
  #9  
Old September 24th, 2002, 07:33 PM
maytricks's Avatar
maytricks maytricks is offline
Always Spell Chek
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2002
Location: NJ, USA
Posts: 338 maytricks User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 58 m 27 sec
Reputation Power: 6
I would rely on a combination of sessions and cookies for security.
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Problem with Cookie Hijacking Test

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

 Free IT White Papers!
 
Accelerating Trading Partner Performance
One in five. That's how many partner transactions have at least one error. That is an amazing statistic, particularly given the extraordinary leaps in innovation across the global supply chain during the past two decades. Download this white paper to learn more.
 
Competing on Analytics
This Tech Analysis is designed to help identify characteristics shared by analytics competitors, and includes information about 32 organizations that have made a commitment to quantitative, fact-based analysis.
 
Cost Effective Scaling with Virtualization and Coyote Point Systems
An overview of the industry trend toward virtualization, how server consolidation has increased the importance of application uptime and the steps being taken to integrate load balancing technology with virtualized servers.
 
Five Checkpoints to Implementing IP Telephony
Implementation planning for IP PBX software and IP telephony has become vital as businesses replace discontinued legacy PBX phone systems. This informative whitepaper outlines five "checkpoints" for any implementation plan that will help make IP communications a successful proposition.
 
Hosted Email Security: Staying Ahead of New Threats
In the last two years, email has become a fierce battleground between the nefarious forces of spam and malware, and the heroes of messaging protection. The spam volumes increased alarmingly every month, bringing clever new forms of phishing and virus propagation attacks.
 

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 3 hosted by Hostway.