Common Attack Vectors: How Cookies Are Stolen
Learn about XSS, malware, and other methods attackers use to steal cookies.
In this lesson, you will learn to:
- Identify and describe at least three common attack vectors used to steal cookies, including XSS and malware.
Common Attack Vectors: How Cookies Are Stolen
This lesson covers the most common attack techniques used to steal cookies, including Cross-Site Scripting (XSS), information-stealing malware, and Man-in-the-Middle attacks.
How Attackers Steal Cookies
Cybercriminals use several methods to steal cookies. Understanding these attack vectors is the first step to defending against them.
Cross-Site Scripting (XSS) – This is one of the most common cookie theft techniques. An attacker injects malicious JavaScript into a vulnerable website. When a user visits the page, the script executes in their browser and can read document.cookie. If the HttpOnly flag is not set, the script sends the cookie to the attacker’s server. The attacker can then use that cookie to impersonate the user.
Information-Stealing Malware – Infostealers may collect cookies and other browser data after reaching a device through malicious downloads, deceptive messages, compromised software, or other delivery paths. The exact data and exfiltration method depend on the malware, browser, permissions, and campaign.
Man-in-the-Middle (MitM) Attacks – When a user connects to an unsecured Wi-Fi network, an attacker can intercept network traffic. If the cookie is transmitted over HTTP instead of HTTPS, the attacker can read the cookie directly from the network packets. This is why the Secure flag is critical.
Session Hijacking (Pass-the-Cookie) – Once an attacker obtains a valid session cookie, they can use it in their own browser to access the user’s account without needing a password or MFA. This is why session cookies are a prime target for attackers.