WEBVTT 0:00:03.420000 --> 0:00:06.420000 Hello everyone and welcome to this video. 0:00:06.420000 --> 0:00:10.640000 In this video, we're going to be taking a closer look at session IDs and 0:00:10.640000 --> 0:00:13.140000 cookies. Now why is this important? 0:00:13.140000 --> 0:00:17.060000 Well, it's important because they play a huge role in session security 0:00:17.060000 --> 0:00:19.880000 or session security testing. 0:00:19.880000 --> 0:00:24.340000 And again, we need to have a little bit more of an understanding as to 0:00:24.340000 --> 0:00:29.820000 how they work. So to begin with, in the context of web application penetration 0:00:29.820000 --> 0:00:35.220000 testing, understanding session IDs and cookies is crucial as these components 0:00:35.220000 --> 0:00:40.880000 play a significant role in user authentication and session management. 0:00:40.880000 --> 0:00:46.240000 So starting off with session IDs, session IDs or session identifiers are 0:00:46.240000 --> 0:00:51.160000 unique tokens or strings that are generated by web applications to identify 0:00:51.160000 --> 0:00:53.960000 and track user sessions. 0:00:53.960000 --> 0:00:58.020000 Okay, they are essential for maintaining stateful communication between 0:00:58.020000 --> 0:01:01.900000 the client, which is the user's browser and the server. 0:01:01.900000 --> 0:01:06.200000 And session IDs are typically used to associate requests from a user with 0:01:06.200000 --> 0:01:10.000000 their session data stored on the server, as I've already explained. 0:01:10.000000 --> 0:01:12.360000 So let's take a look at an example, right? 0:01:12.360000 --> 0:01:16.940000 Suppose you're conducting a penetration test on a an e-commerce website. 0:01:16.940000 --> 0:01:24.040000 After user logs in, the server generates a session ID. 0:01:24.040000 --> 0:01:28.280000 So for associates, it with the user session, the session ID is then sent 0:01:28.280000 --> 0:01:30.860000 to the user's browser as a cookie. 0:01:30.860000 --> 0:01:36.140000 So the cookie is now what lies on the client side and is used to essentially 0:01:36.140000 --> 0:01:39.200000 tell the server, this is my session ID. 0:01:39.200000 --> 0:01:44.300000 Could you please again, send me the load up the web page or send me the 0:01:44.300000 --> 0:01:48.660000 web page based on my preferences or in the case of access permissions, 0:01:48.660000 --> 0:01:53.860000 your session ID identifies your user account and the consequent permissions 0:01:53.860000 --> 0:01:57.880000 associated with that account to ensure that you don't have any additional 0:01:57.880000 --> 0:02:00.060000 permissions or anything like that. 0:02:00.060000 --> 0:02:03.460000 So you're starting, you probably are starting to get an idea as to why 0:02:03.460000 --> 0:02:08.200000 session IDs are so important, more specifically through cookies, because 0:02:08.200000 --> 0:02:13.400000 you essentially modify or play around with session IDs by performing cookie 0:02:13.400000 --> 0:02:16.560000 tampering or cookie manipulation. 0:02:16.560000 --> 0:02:18.900000 So that brings us to cookies now. 0:02:18.900000 --> 0:02:20.200000 So what are cookies? 0:02:20.200000 --> 0:02:22.140000 Because you need to understand what they are. 0:02:22.140000 --> 0:02:24.300000 Cookies are small pieces of data. 0:02:24.300000 --> 0:02:27.960000 And generally speaking, usually text, they can be an encoded format. 0:02:27.960000 --> 0:02:28.920000 That's perfectly fine. 0:02:28.920000 --> 0:02:32.500000 Or even encrypted format or hashed formats. 0:02:32.500000 --> 0:02:36.540000 So they're small pieces of data that a web server sends to the user's 0:02:36.540000 --> 0:02:38.880000 browser, which stores them locally. 0:02:38.880000 --> 0:02:41.080000 So your cookies are stored locally. 0:02:41.080000 --> 0:02:44.700000 And cookies serve various purposes, such as session management, as I stated 0:02:44.700000 --> 0:02:48.800000 in the previous video, user tracking and personalization. 0:02:48.800000 --> 0:02:52.360000 And in the context of session management, session cookies are commonly 0:02:52.360000 --> 0:02:56.920000 used to store the session ID, allowing the server to recognize and maintain 0:02:56.920000 --> 0:02:58.840000 the user session. 0:02:58.840000 --> 0:03:02.580000 For example, during a penetration test, you discover that the website 0:03:02.580000 --> 0:03:05.140000 uses cookies for session management. 0:03:05.140000 --> 0:03:10.420000 When a user logs in, the server sends a cookie named session ID with the 0:03:10.420000 --> 0:03:14.200000 value session 1, 2, 3, 4, 5 to the user's browser. 0:03:14.200000 --> 0:03:18.400000 Now, on subsequent requests, the browser includes this cookie, allowing 0:03:18.400000 --> 0:03:23.100000 the server to identify and associate the user's requests with that particular 0:03:23.100000 --> 0:03:25.000000 session or with their session. 0:03:25.000000 --> 0:03:28.160000 So it's very, very simple in terms of what's going on in the background. 0:03:28.160000 --> 0:03:31.980000 And I really wanted to cover this even though it was a very, very short 0:03:31.980000 --> 0:03:36.520000 video to give you that general clarification regarding the link between 0:03:36.520000 --> 0:03:38.300000 session IDs and cookies. 0:03:38.300000 --> 0:03:42.160000 And now that we've done that, we're now going to turn our attention to 0:03:42.160000 --> 0:03:46.820000 session hijacking and session fixation in terms of, you know, what types 0:03:46.820000 --> 0:03:48.300000 of attacks they are. 0:03:48.300000 --> 0:03:52.240000 And then we'll also be taking a look at a practical example as to, you 0:03:52.240000 --> 0:03:57.340000 know, how you can perform cookie tampering to, let's say, impersonate 0:03:57.340000 --> 0:04:01.820000 a particular user specifically through session hijacking. 0:04:01.820000 --> 0:04:05.900000 But with that being said, that is going to be it for this video. 0:04:05.900000 --> 0:04:08.060000 And I'll be seeing you in the next video.