Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-sess-02O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | wstg-sess-02 |
| description | Testing for Cookies Attributes |
| category | session-management |
| owasp_id | WSTG-SESS-02 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["session","cookies","csrf","token","wstg","sess"] |
| tech_stack | [] |
| cwe_ids | ["CWE-384"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-SESS-02
Testing for Cookies Attributes
Cookie attributes control how browsers handle cookies, including security restrictions. Improperly configured cookie attributes can expose session tokens to theft via XSS attacks, man-in-the-middle attacks, or cross-site request forgery. This test examines whether cookies are configured with appropriate security attributes including Secure, HttpOnly, SameSite, Domain, Path, and Expires/Max-Age.
| Attribute | Missing Impact |
|---|---|
| Secure | Token sent over HTTP |
| HttpOnly | XSS can steal token |
| SameSite | CSRF attacks possible |
| Proper Domain | Subdomain attacks |
| Proper Path | Broader exposure |
#!/bin/bash
# Capture and analyze all cookies
TARGET="https://target.com"
# Get all Set-Cookie headers
echo "=== All Set-Cookie Headers ==="
curl -sI "$TARGET" | grep -i "set-cookie"
# After authentication
echo -e "\n=== Post-Auth Cookies ==="
curl -s -c - -X POST "/login" \
-d | grep -v
curl -sI | grep -i | -r line;
| | -r attr;
#!/bin/bash
# Comprehensive cookie attribute checker
TARGET="https://target.com"
cookies=$(curl -sI "$TARGET" | grep -i "set-cookie")
echo "=== Cookie Security Analysis ==="
while IFS= read -r cookie; do
name=$(echo "$cookie" | sed 's/Set-Cookie: //' | cut -d= -f1)
echo -e "\n[Cookie: $name]"
# Check Secure flag
if echo "$cookie" | grep -qi "secure"; then
echo " [OK] Secure flag present"
else
echo " [VULN] Missing Secure flag"
fi
# Check HttpOnly flag
if echo "$cookie" | grep -qi "httponly"; then
echo " [OK] HttpOnly flag present"
else
echo " [VULN] Missing HttpOnly flag"
fi
# Check SameSite attribute
if echo "$cookie" | grep -qi "samesite=strict"; then
echo " [OK] SameSite=Strict"
elif echo "$cookie" | grep -qi "samesite=lax"; then
echo " [WARN] SameSite=Lax (consider Strict for sensitive cookies)"
elif echo "$cookie" | grep -qi "samesite=none"; then
echo " [WARN] SameSite=None (requires Secure flag)"
else
echo " [WARN] Missing SameSite attribute"
fi
# Check Domain
if echo "$cookie" | grep -qi "domain="; then
domain=$(echo "$cookie" | grep -oP "domain=[^;]+" | cut -d= -f2)
echo " [INFO] Domain: $domain"
if echo "$domain" | grep -q "^\."; then
echo " [WARN] Leading dot allows subdomain access"
fi
else
echo " [OK] No Domain (origin only)"
fi
# Check Path
if echo "$cookie" | grep -qi "path="; then
path=$(echo "$cookie" | grep -oP "path=[^;]+" | cut -d= -f2)
echo " [INFO] Path: $path"
if [ "$path" == "/" ]; then
echo " [WARN] Path=/ (entire site)"
fi
fi
# Check Expires/Max-Age
if echo "$cookie" | grep -qiE "expires=|max-age="; then
echo " [INFO] Persistent cookie (has expiration)"
else
echo " [OK] Session cookie (expires on browser close)"
fi
done <<< "$cookies"
#!/bin/bash
# Test cookie prefixes (__Host-, __Secure-)
TARGET="https://target.com"
# __Host- prefix requirements:
# - Must have Secure flag
# - Must not have Domain attribute
# - Path must be /
# - Must be set from secure origin
# __Secure- prefix requirements:
# - Must have Secure flag
# - Must be set from secure origin
echo "=== Testing Cookie Prefixes ==="
# Check for __Host- cookies
curl -sI "$TARGET" | grep -i "set-cookie.*__Host-" && \
echo "[OK] Using __Host- prefix" || \
echo "[INFO] Not using __Host- prefix"
# Check for __Secure- cookies
curl -sI "$TARGET" | grep -i "set-cookie.*__Secure-" && \
echo "[OK] Using __Secure- prefix" || \
echo "[INFO] Not using __Secure- prefix"
#!/bin/bash
# Test if cookies are sent over HTTP
# This test requires both HTTP and HTTPS access
HTTP_TARGET="http://target.com"
HTTPS_TARGET="https://target.com"
# Get session from HTTPS
session=$(curl -s -c - "$HTTPS_TARGET/login" -d "user=test&pass=test" | \
grep -oP "SESSIONID=\K[^;]+")
# Try to use session over HTTP
response=$(curl -s -b "SESSIONID=$session" "$HTTP_TARGET/protected")
if echo "$response" | grep -qi "authenticated\|welcome"; then
echo "[VULN] Session cookie accepted over HTTP"
else
echo "[OK] Session cookie not sent/accepted over HTTP"
fi
// Browser console test - check if session cookies are accessible
// If accessible, XSS can steal them
console.log("=== Cookies accessible via JavaScript ===")
console.log(document.cookie)
// Check for specific session cookies
const cookies = document.cookie.split(";")
cookies.forEach((cookie) => {
const [name, value] = cookie.trim().split("=")
if (
name.toLowerCase().includes("session") ||
name.toLowerCase().includes("token") ||
name.toLowerCase().includes("auth")
) {
console.log(`[VULN] Sensitive cookie accessible: ${name}`)
}
})
// If session cookies appear, HttpOnly is missing
#!/usr/bin/env python3
import requests
from http.cookies import SimpleCookie
class CookieAnalyzer:
def __init__(self, url):
self.url = url
self.session = requests.Session()
self.findings = []
def analyze(self):
"""Analyze all cookie attributes"""
print(f"[*] Analyzing cookies from {self.url}")
response = self.session.get(self.url)
for cookie in self.session.cookies:
print(f"\n{'='*50}")
print(f"Cookie: {cookie.name}")
print(f"{'='*50}")
self._analyze_cookie(cookie, response)
return self.findings
def _analyze_cookie(self, cookie, response):
"""Analyze individual cookie"""
# Check Secure flag
if cookie.secure:
print(f" [OK] Secure: True")
else:
print(f" [VULN] Secure: False")
self.findings.append({
"cookie": cookie.name,
"issue": "Missing Secure flag",
"severity": "High",
"recommendation": "Add Secure flag to cookie"
})
# Check HttpOnly (need to check raw header)
set_cookie_headers = response.headers.get('Set-Cookie', '')
if cookie.name in set_cookie_headers:
if 'httponly' in set_cookie_headers.lower():
print(f" [OK] HttpOnly: True")
else:
print(f" [VULN] HttpOnly: False")
self.findings.append({
"cookie": cookie.name,
"issue": "Missing HttpOnly flag",
"severity": "High",
"recommendation": "Add HttpOnly flag to prevent XSS theft"
})
# Check SameSite
if 'samesite=strict' in set_cookie_headers.lower():
print(f" [OK] SameSite: Strict")
elif 'samesite=lax' in set_cookie_headers.lower():
print(f" [WARN] SameSite: Lax")
elif 'samesite=none' in set_cookie_headers.lower():
print(f" [WARN] SameSite: None (cross-site allowed)")
if not cookie.secure:
self.findings.append({
"cookie": cookie.name,
"issue": "SameSite=None without Secure flag",
"severity": "High",
"recommendation": "SameSite=None requires Secure flag"
})
else:
print(f" [WARN] SameSite: Not set")
self.findings.append({
"cookie": cookie.name,
"issue": "Missing SameSite attribute",
"severity": "Medium",
"recommendation": "Add SameSite=Strict or Lax"
})
# Check Domain
print(f" Domain: {cookie.domain or '(not set - origin only)'}")
if cookie.domain and cookie.domain.startswith('.'):
self.findings.append({
"cookie": cookie.name,
"issue": f"Domain with leading dot ({cookie.domain})",
"severity": "Low",
"recommendation": "Review if subdomain access is needed"
})
# Check Path
print(f" Path: {cookie.path}")
if cookie.path == '/':
print(f" [INFO] Cookie available to entire site")
# Check Expiration
if cookie.expires:
import datetime
exp_date = datetime.datetime.fromtimestamp(cookie.expires)
print(f" Expires: {exp_date}")
# Check for very long expiration
days_until_expire = (exp_date - datetime.datetime.now()).days
if days_until_expire > 365:
self.findings.append({
"cookie": cookie.name,
"issue": f"Long expiration ({days_until_expire} days)",
"severity": "Low",
"recommendation": "Consider shorter cookie lifetime"
})
else:
print(f" Expires: Session (browser close)")
# Check value characteristics
print(f" Value length: {len(cookie.value)}")
if len(cookie.value) < 16:
print(f" [WARN] Short cookie value")
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("COOKIE SECURITY REPORT")
print("="*60)
if not self.findings:
print("\nNo security issues found!")
return
print(f"\nTotal findings: {len(self.findings)}")
# Group by severity
for severity in ['High', 'Medium', 'Low']:
issues = [f for f in self.findings if f['severity'] == severity]
if issues:
print(f"\n{severity.upper()} ({len(issues)}):")
for issue in issues:
print(f" [{issue['cookie']}] {issue['issue']}")
print(f" → {issue['recommendation']}")
# Usage
analyzer = CookieAnalyzer("https://target.com")
analyzer.analyze()
analyzer.generate_report()
| Tool | Description | Usage |
|---|---|---|
| Browser DevTools | Cookie inspection | Application > Cookies |
| Cookie-Editor | Browser extension | Edit/analyze cookies |
| Burp Suite | Traffic analysis | Cookie interception |
| Tool | Description |
|---|---|
| curl | Command-line testing |
| Custom scripts | Automated analysis |
# Flask example
from flask import Flask, make_response
app = Flask(__name__)
# Global session cookie settings
app.config.update(
SESSION_COOKIE_SECURE=True,
SESSION_COOKIE_HTTPONLY=True,
SESSION_COOKIE_SAMESITE='Strict',
SESSION_COOKIE_NAME='__Host-session', # Use prefix
)
# For custom cookies
@app.route('/set-cookie')
def set_cookie():
response = make_response("Cookie set")
response.set_cookie(
'__Host-session',
value=generate_session_id(),
secure=True,
httponly=True,
samesite='Strict',
path='/',
max_age=3600 # 1 hour
# No domain - __Host- requires this
)
return response
const express = require("express")
const session = require("express-session")
const app = express()
app.use(
session({
name: "__Host-session",
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
cookie: {
secure: true, // HTTPS only
httpOnly: true, // No JavaScript access
sameSite: "strict", // CSRF protection
maxAge: 3600000, // 1 hour
path: "/",
// domain not set for __Host- prefix
},
}),
)
// For individual cookies
app.get("/set-cookie", (req, res) => {
res.cookie("preference", "value", {
secure: true,
httpOnly: true,
sameSite: "strict",
maxAge: 86400000,
path: "/settings",
})
res.send("Cookie set")
})
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;
@Configuration
public class SessionConfig {
@Bean
public CookieSerializer cookieSerializer() {
DefaultCookieSerializer serializer = new DefaultCookieSerializer();
serializer.setCookieName("__Host-SESSION");
serializer.setUseSecureCookie(true);
serializer.setUseHttpOnlyCookie(true);
serializer.setSameSite("Strict");
serializer.setCookiePath("/");
serializer.setCookieMaxAge(3600); // 1 hour
return serializer;
}
}
# Add security headers for all cookies
add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Strict";
# Proxy cookie configuration
proxy_cookie_flags ~ secure httponly samesite=strict;
# Or in location block
location / {
proxy_pass http://backend;
proxy_cookie_path / "/; Secure; HttpOnly; SameSite=Strict";
}
| Finding | CVSS | Severity |
|---|---|---|
| Missing Secure flag on session | 7.5 | High |
| Missing HttpOnly on session | 6.1 | Medium |
| SameSite=None without Secure | 6.5 | Medium |
| Missing SameSite | 4.3 | Medium |
| Overly broad Domain | 4.3 | Medium |
| CWE ID | Title | Description |
|---|---|---|
| CWE-614 | HTTPS Cookie Without Secure | Missing Secure flag |
| CWE-1004 | Cookie Without HttpOnly | XSS accessible |
| CWE-1275 | Cookie With SameSite=None | CSRF risk |
| CWE-565 | Reliance on Cookies Without Validation | Cookie trust |
[ ] All cookies identified
[ ] Secure flag checked
[ ] HttpOnly flag checked
[ ] SameSite attribute checked
[ ] Domain scope analyzed
[ ] Path scope analyzed
[ ] Expiration settings reviewed
[ ] Cookie prefixes considered
[ ] HTTP downgrade tested
[ ] JavaScript accessibility tested
[ ] Findings documented
[ ] Remediation recommendations provided