PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

portswigger.net | research | #cookies | #asp-net | #unicode | #django | #cookie-tossing | #session-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.
Published
Collected

Related coverage

research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Stealing HttpOnly cookies with the cookie sandwich technique
The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.
research · portswigger.net
Splitting the email atom: exploiting parsers to bypass access controls
Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
research · portswigger.net
Bypassing character blocklists with unicode overflows
Unicode codepoint truncation turns overflow values into blocked ASCII characters — 0x4e41 % 256 yields 'A' — bypassing character blocklists; the trick now ships in ActiveScan++ and Hackvertor.
research · portswigger.net
Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing
Gareth Heyes uses visual fuzzing with headless Chrome and puppeteer to hunt Unicode combining characters that form render-defect Zalgo JavaScript, valid on Edge.
research · portswigger.net
Web Storage: the lesser evil for session tokens
James Kettle argues Web Storage (sessionStorage/localStorage) is often a safer home for session tokens than cookies, examining the Secure flag, HttpOnly and the path attribute.
Back