Cookies COEN 351 E-commerce Security. Client / Session Identification HTTP Headers Client IP Address HTTP User Login FAT URLs Cookies.

Slides:

Advertisements

Similar presentations

Cryptography Chapter 7 Part 4 Pages 833 to 874. PKI Public Key Infrastructure Framework for Public Key Cryptography and for Secret key exchange.

Advertisements

Copyright © 2012 Certification Partners, LLC -- All Rights Reserved Lesson 4: Web Browsing.

1 Client Identification and Cookies Herng-Yow Chen.

Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation.

1 Configuring Internet- related services (April 22, 2015) © Abdou Illia, Spring 2015.

A Third Party Service for Providing Trust on the Internet Work done in 2001 at HP Labs by Michael VanHilst and Ski Ilnicki.

6/10/2015Cookies1 What are Cookies? 6/10/2015Cookies2 How did they do that?

XP Browser and Basics1. XP Browser and Basics2 Learn about Web browser software and Web pages The Web is a collection of files that reside.

Online Security Tuesday April 8, 2003 Maxence Crossley.

Servlets and a little bit of Web Services Russell Beale.

Information Networking Security and Assurance Lab National Chung Cheng University The Ten Most Critical Web Application Security Vulnerabilities Ryan J.W.

1 The World Wide Web. 2  Web Fundamentals  Pages are defined by the Hypertext Markup Language (HTML) and contain text, graphics, audio, video and software.

Browser and Basics Tutorial 1. Learn about Web browser software and Web pages The Web is a collection of files that reside on computers, called.

Client, Server, HTTP, IP Address, Domain Name. Client-Server Model Client Bob Yahoo Server yahoo.com/finance.html A text file named finance.html.

Cookies COEN 351 E-commerce Security. Client / Session Identification HTTP does not maintain state. State Information can be passed using: HTTP Headers.

Web Application Vulnerabilities Checklist. EC-Council Parameter Checklist  URL request  URL encoding  Query string  Header  Cookie  Form field 

Lecturer: Ghadah Aldehim

Computer Concepts 2014 Chapter 7 The Web and .

ITIS 1210 Introduction to Web-Based Information Systems Chapter 48 How Internet Sites Can Invade Your Privacy.

Open Source Server Side Scripting ECA 236 Open Source Server Side Scripting Cookies & Sessions.

Cookies Set a cookie – setcookie() Extract data from a cookie - $_COOKIE Augment user authentication script with a cookie.

CHAPTER 12 COOKIES AND SESSIONS. INTRO HTTP is a stateless technology Each page rendered by a browser is unrelated to other pages – even if they are from.

Comp2513 Forms and CGI Server Applications Daniel L. Silver, Ph.D.

_______________________________________________________________________________________________________________ E-Commerce: Fundamentals and Applications1.

IT533 Lectures Session Management in ASP.NET. Session Tracking 2 Personalization Personalization makes it possible for e-businesses to communicate effectively.

CP476 Internet Computing Lecture 5 : HTTP, WWW and URL 1 Lecture 5. WWW, HTTP and URL Objective: to review the concepts of WWW to understand how HTTP works.

Adapted from Computer Concepts, New Perspectives, Thompson Course Technology EDW 647: The Internet Dr. Roger Webster & Dr. Nazli Mollah 24 Cookies: What.

Working with Cookies Managing Data in a Web Site Using JavaScript Cookies* *Check and comply with the current legislation regarding handling cookies.

CSE 154 LECTURE 12: COOKIES. Including files: include include("filename"); PHP include("header.html"); include("shared-code.php"); PHP inserts the entire.

Chapter 1: The Internet and the WWW CIS 275—Web Application Development for Business I.

Chapter 8 Cookies And Security JavaScript, Third Edition.

12/3/2012ISC329 Isabelle Bichindaritz1 PHP and MySQL Advanced Features.

Week seven CIT 354 Internet II. 2 Objectives Database_Driven User Authentication Using Cookies Session Basics Summary Homework and Project 2.

E-COMMERCE JOBS This project (Project number: HU/01/B/F/PP ) is carried out with the financial support of the Commssion of the European Communities.

Lecture 8 – Cookies & Sessions SFDV3011 – Advanced Web Development 1.

Protecting Students on the School Computer Network Enfield High School.

ITEC 1001 Tutorial 1 Browser and Basics. Web browser software & Web pages The Web is a collection of files that reside on computers, called Web.

1 Chapter 9 – Cookies, Sessions, FTP, and More spring into PHP 5 by Steven Holzner Slides were developed by Jack Davis College of Information Science.

Web Database Programming Week 7 Session Management & Authentication.

Cookies and Sessions IDIA 618 Fall 2014 Bridget M. Blodgett.

A Little Bit About Cookies Fort Collins, CO Copyright © XTR Systems, LLC A Little Bit About Cookies Instructor: Joseph DiVerdi, Ph.D., M.B.A.

1-1 HTTP request message GET /somedir/page.html HTTP/1.1 Host: User-agent: Mozilla/4.0 Connection: close Accept-language:fr request.

CS 4244: Internet Programming Security 1.0. Introduction Client identification and cookies Basic Authentication Digest Authentication Secure HTTP.

© 2010 Computer Science Faculty, Kabul University HTTP CONTINUED… 4 TH LECTURE 2, May, 2010 Baseer Ahmad Baheer.

Cookies Bill Chu. © Bei-Tseng Chu Aug 2000 Definition A cookie is a TEXT object of max 4KB sent from a web server to a browser It is intended for the.

Chapter 16 The World Wide Web. FIGURE 16.0.F01: A very, very simple Web page. Courtesy of Dr. Richard Smith.

Saving State on the WWW. The Issue  Connections on the WWW are stateless  Every time a link is followed is like the first time to the server — it has.

CP476 Internet Computing CGI1 Cookie –Cookie is a mechanism for a web server recall info of accessing of a client browser –A cookie is an object sent by.

ECMM6018 Enterprise Networking for Electronic Commerce Tutorial 7

CIS 451: Cookies Dr. Ralph D. Westfall February, 2009.

SESSIONS 27/2/12 Lecture 8. ? Operator Similar to the if statement but returns a value derived from one of two expressions by a colon. Syntax: (expression)

ITM © Port,Kazman 1 ITM 352 Cookies. ITM © Port,Kazman 2 Problem… r How do you identify a particular user when they visit your site (or any.

Session Management Tyler Moore CS7403 University of Tulsa Slides adapted in part or whole from Dan Boneh, Stanford CS155 1.

COEN 350: Network Security E-Commerce Issues. Table of Content HTTP Authentication Cookies.

Unit-6 Handling Sessions and Cookies. Concept of Session Session values are store in server side not in user’s machine. A session is available as long.

Session 11: Cookies, Sessions ans Security iNET Academy Open Source Web Development.

1 Chapter 22 World Wide Web (HTTP) Chapter 22 World Wide Web (HTTP) Mi-Jung Choi Dept. of Computer Science and Engineering

PHP: Further Skills 02 By Trevor Adams. Topics covered Persistence What is it? Why do we need it? Basic Persistence Hidden form fields Query strings Cookies.

© Janice Regan, CMPT 128, Jan 2007 CMPT 371 Data Communications and Networking HTTP 0.

Some from Chapter 11.9 – “Web” 4 th edition and SY306 Web and Databases for Cyber Operations Cookies and.

Programming for the Web Cookies & Sessions Dónal Mulligan BSc MA

Cookies Tutorial Cavisson Systems Inc..

19.10 Using Cookies A cookie is a piece of information that’s stored by a server in a text file on a client’s computer to maintain information about.

Chapter 8 Building the Transaction Database

Chapter 19 PHP Part III Credits: Parts of the slides are based on slides created by textbook authors, P.J. Deitel and H. M. Deitel by Prentice Hall ©

Client / Session Identification Cookies

What is Cookie? Cookie is small information stored in text file on user’s hard drive by web server. This information is later used by web browser to retrieve.

Client / Session Identification Cookies

Configuring Internet-related services

Web Programming Language

Presentation transcript:

Cookies COEN 351 E-commerce Security

Client / Session Identification HTTP Headers Client IP Address HTTP User Login FAT URLs Cookies

Client / Session Identification HTTP Header fields: “From” User’s address, request. Could be used by all browsers, but are only used for web-bots gathering data. “User-Agent” User’s browser software, request. “Referer” (Sic) Page user came from by following link

Client / Session Identification HTTP Header fields: “Authorization” User name and password “Client-ip” “X-Forwarded-For” Client-ip “Cookie”

Client / Session Identification User-Agent Gives the server information about the browser.

Client / Session Identification Client IP Address Not part of the HTTP header Available from the package Easily spoofed Changed by NATs and Proxies

Client / Session Identification HTTP login based on WWW-Authenticate and Authorization headers. 1. Browser requests page with GET 2. Server anwsers with: 401 Login Required, WWW-authenticate: Basic realm=“joe” 3. Browser resends GET request, adds Authorization: Basic am98re45 4. Server fulfills request. 5. Browser now will resend stored user-name with every request.

Client / Session Identification Fat URL Maintain state information in the URL Server generates a session id. Server adds session id to all URLs requested from the hyperlink. Amazon.com uses this technique. html/ html/ /ref=s9_ts_r/ /ref=s9_ts_r/ _shr/ _shr/

Cookies Cookies: ASCI strings stored at the browser. Submitted with each request to a target website.

Cookies Cookies: Session cookies Stored only for the duration of a web-session. Persistent cookies Remain stored until they expire.

Cookies Cookie-Jar Client-side state storage Netscape / Firefox store cookies in a single text file called cookies.txt MS IE stores cookies in the cache.

Cookies Server specifies optional domain. Cookie gets sent with all requests to this domain. Server specifies optional expiration date Server can specify “secure” option: Cookie is only sent when using SSL.

Cookies Version 0 cookies (Netscape cookies) Set-Cookie: name=value [;expires=date] [;path=path] [;domain-name = value] [;secure] Set-Cookie: customer=Mary; expires Wednesday, 09- September :00:01 GMT; domain=“scu.edu”; path=/soe; secure

Cookies Version 1 cookies (RFC 296) Less-used Provides a number of extensions

Cookies Privacy risk Can be controlled by web-browser. Used to track consumer behavior. Harder, but possible to track an individual user.

Cookies Security Risk Users can change cookies before continuing to browse. Counter-measure: strong encryption Users could swap / steal cookies. E.g. when used for authentication Session Hijacking

Cookies Session Hijacking Counter measure: Server needs to send a new cookie after every change in state and verify that a request comes with a valid cookie. For example, by appending a MAC of session state to the cookie after each change of state.

Cookies Poor practices: Poor encryption of cookies. Web-based uses a cookie for authentication. Cookie contains the user name encrypted by XOR-ing with a secret string. Attacker can crack the cookie encryption by creating fake accounts. Attacker can now craft a cookie useful for authentication. Something similar happened to hotmail and yahoo early on.

Cookies Poor practices: Poor encryption of cookies. Shopping cart encoded in cookie. Cookie contained shopping cart details in plain text. Attacker changed prices of items. Relying on cookie for authentication Cookie is sniffed from the net. Cookie is stolen by impersonating a web-site.

Cookie Alternative: Web Bugs Used to track viewers of web-sites. HTML page contains a request to download a resource from a “counting” site. The resource is so small that the viewer does not notice the download. Counting site receives the request and adds IP address to its user database.

Cookie Alternative: Web Bugs Examples: Found by Privacy Foundation on Intuit’s home page for Quicken.com several years ago. <IMG WIDTH=1 HEIGHT=1 border=0 SRC=“ nOfSite_Any&db_acfr=4B31-C2FB- 10E2&event=reghome&group=register&time= ”>

Cookie Alternative: Web Bugs Can be embedded in any html code. User profiles written in html. messages. But only when read with a client that can display HTML messages and with a computer connected to the internet. Usenet messages.