1. Cross-Site Scripting
   1. 1. Assume that value of the Cookie Parameter "Name" is reflected in the application.
   2. 2. Change the "Name" value to "XSS Payload" and it may result into a XSS.
2. Insufficient Session Management
   1. Session Doesn't Expire on Logout
      1. On Server-Side Only
      2. Both Server-Side & Client-Side
   2. Long Session Expiry
   3. Session Doesn't Expire on Password Reset/Change
   4. Concurrent Session
3. Session Fixation
   1. An attacker tricks the victim user to use a Session Identifier which is known to the attacker.
   2. Read: https://secureteam.co.uk/articles/web-application-security-articles/understanding-session-fixation-attacks/
4. Privilege Escalation
   1. Horizontal
      1. 1. Assume that the application uses Multi-Organization Model.
      2. 2. Cookies are used to define which organization a user can access.
      3. 3. Alter the Cookies in order to Access some other Organization.
   2. Vertical
      1. 1. Assume that the cookies are used to determine the "Role" of the User.
      2. 2. Alter the Cookies in order to Elevate the "Role" of the User.
   3. Similarly, Try if the Lower user's cookies can be used to access Higher User's Functions or Try if the cookies of Organization 1 user can be used to Access functions of Organization 2.
5. Insecure Direct Object Reference
   1. 1. If the cookies are using some access defining parameter such as "user_id"
   2. 2. Change the value of these parameter in order to check if you can access other user's data.
6. Missing Cookie Security Attributes
   1. Missing HTTPOnly Flag
   2. Missing Secure Flag
   3. Missing Same-Site Flag
7. Guessable/Weak Cookie
   1. 1. Check if the cookies are not generated Randomly by issues multiple cookies and analyzing them.
   2. 2. Check if some weak/known cryptography is used. Let's assume the cookies are using Base64 Encoding and can be decoded/forged easily.
8. Session Puzzling
   1. 1. When an application utilizes the same session variable for multiple purposes, this can be abused by an attacker to trick the application and perform the action as an authenticated or privileged user.
   2. 2. Read: https://github.com/harsh-bothra/learn365/blob/main/days/day17.md
9. File Inclusion
   1. 1. If a cookie is used to define some server-side attribute that can be controlled by a user, try for File Inclusion Attacks.
   2. Read: https://medium.com/@tehmezovismayil/cookie-based-php-local-file-inclusion-bug-bounty-553f8b38d4dc
10. Padding Oracle Attack
    1. Read: https://book.hacktricks.xyz/pentesting-web/hacking-with-cookies#advanced-cookies-attacks
11. CBC-MAC/ECB Encryption
    1. Read: https://book.hacktricks.xyz/pentesting-web/hacking-with-cookies#advanced-cookies-attacks
12. Authentication Bypass (Cookies are not Validated)
    1. 1. Try accessing a protected resource by removing cookies.
13. Parameter Pollution
    1. 1. Assume that the cookies utilize a parameter called "user_id=" to retrieve some data.
    2. 2. However, the application is not vulnerable to IDOR and changing "user_id=" to victim value, doesn't help out.
    3. 3. Attacker, add an additional "user_id=" parameter value to the cookie with victim's user ID. Like: "user_id=attacker&user_id=victim"
    4. 4. Three things can happen here: - The application may retrieve data of Victim User. - The Application may retrieve data of both Attacker & Victim User. - The Application is not vulnerable and doesn't return anything.
14. SQL Injection
    1. Read: https://resources.infosecinstitute.com/topic/cookie-based-sql-injection/
15. Denial of Service - Cookie Bomb
    1. 1. Forcing the server to process cookies larger than the restricted cookie size defined by the server may cause Denial of Service Attack.
    2. Read: https://blog.innerht.ml/tag/cookie-bomb/
16. Mass Assignment
    1. 1. Similar to the Parameter Pollution, However, in this, Attacker tried to Inject multiple User ID in same user_id parameter.
17. Arbitrary Cookie Injection
    1. 1. Try Injecting some Arbitrary Cookies using Attacks such as CRLF Injection.
    2. 2. Sometimes it can be used to escalate privilege or if the application malfunction, it can reveal sensitive information through Stack Traces.
18. Insecure Deserialization
    1. 1. If cookies are using Serialized Objects, try performing Insecure Deserialization Checks.
    2. Read: https://portswigger.net/web-security/deserialization/exploiting
19. Cookie Length Violation
    1. It may cause attacks such as Buffer Overflows
    2. Read: https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_value_length_violation.htm
20. Session Donation
    1. Read: https://book.hacktricks.xyz/pentesting-web/hacking-with-cookies#session-donation
21. Sensitive Data Stored in Cookies
    1. Check if any PII or Other Sensitive Information Stored in Cookies
    2. This information usually includes: Email, Date of Birth, Mobile, Address, SSN, Etc.
22. Created By: Harsh Bothra Twitter: @harshbothra_