41. Session Hijacking – Tokens, Cookies and Defence
41.9 Lab-Safe PHP Cookie Demo + Ethics / IT Act
Allowed pattern (same spirit as DoS chapter):
- Build weak login you own on host-only
- From Kali, steal/replay that cookie only
- Measure impact; stop
- Fix flags + regenerate + HTTPS; re-test
- Snapshot / revert
Banned: café Wi-Fi Firesheep-style against strangers, phishing coworkers for cookies, XSS on live .in shops, selling session tools.
Ethics line for notes: written permission + own lab; IT Act awareness (sections such as 43 and 66 – verify); responsible disclosure if you ever find a real bug – never "demo" on production without contract.
# Kali → YOUR lab only – cookie replay concept (after you captured Cookie from your browser/Burp)
# curl -s -H 'Cookie: PHPSESSID=PASTE_YOUR_LAB_VALUE' http://192.168.56.40/dashboard.php
# After fix (HTTPS + regenerate): old value should fail; new login gets new SID
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Ignores scope; sniffs campus Wi-Fi | Written lab scope; host-only networking; legal reminder |
| Shares stolen cookies in WhatsApp group | Blue teaches: that is account takeover material – never |
| Leaves weak app on bridged adapter | Host-only / NAT lab; snapshot hygiene |
Ravindra Bagale's Tip
"Bas ekda café madhe try" = career + legal risk. CEH exam modules pan authorization first. Own VM. Dhyan rakho.
Lab
Pair: one builds weak PHP login; other replays cookie from Kali; both sign ethics paragraph. Switch. No bridged LAN.
Project: Build it, hack it, fix it
Build: On YOUR host-only lab VM (e.g. 192.168.56.40), LEMP/LAMP with a tiny PHP login for fictional Raja-Rani Traders staff portal (users rani / lab password in local DB only). Deliberate weaknesses: (1) session cookie without HttpOnly / Secure / SameSite, (2) HTTP only (no TLS), (3) no session_regenerate_id after login, (4) optional bad path: echo session ID in a URL link on dashboard, (5) long session.gc_maxlifetime. Snapshot pre-weak-session. Hack (lab only): From Kali 192.168.56.10, log in via browser or curl; capture PHPSESSID (DevTools / curl -c / Burp against host-only). Replay cookie with curl/Burp from Kali without password – open /dashboard.php as Rani. Optional: tcpdump on port 80 to show Cookie in cleartext. Never target public sites or real staff. Fix: Enable HTTPS (self-signed OK); session.cookie_httponly=1, session.cookie_secure=1, SameSite=Lax; call session_regenerate_id(true) after successful auth; remove SID from URLs; shorten TTL; logout calls session_destroy(). sudo nginx -t / sudo apachectl configtest then sudo service nginx reload (or httpd). Re-verify: Old stolen cookie fails; new login issues new SID; curl over HTTP does not get Secure cookie; document for owner Rani. Purple note: Red proved identity theft via session; Blue proved cookie flags + regenerate + HTTPS without touching the internet.