Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
Автор: Black Hat
Загружено: 2024-01-26
Просмотров: 2544
Cookies have a long history of vulnerabilities targeting their confidentiality and integrity. To address these issues, new mechanisms have been proposed and implemented in browsers and server-side applications. Notably, the updated cookie standard RFC6265bis improved the Secure attribute and introduced cookie prefixes to strengthen cookie integrity against network and same-site attackers, whereas the SameSite attribute has been touted as the solution to CSRF. On the server, token-based protections are considered an effective defense for CSRF in the synchronizer token pattern variant.
In this talk, we will focus on real-world security implications of cookie integrity issues and show how security mechanisms previously considered robust can be bypassed, exposing Web applications to session integrity attacks such as session fixation and cross-origin request forgery (CORF)....
By: Pedro Adão , Marco Squarcina
Full Abstract and Presentation Materials: https://www.blackhat.com/us-23/briefi...
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
