Project 11: Cookie Cadger (15 pts.)

What you need

A Kali Linux machine, real or virtual. This is the Attacker.
A second computer of any type on the same network as the Kali machine. This is the Target.

Purpose

To see how cookies are used by websites for authentication, and perform CSRF (Cross-Site Request Forgery) attacks.

Testing Networking

Finding the KALI Linux Machine's IP Address

Use the ifconfig command on the Kali Linux machine to find its IP address.

Ping the Kali machine from the Windows machine. If you don't get replies, you need to troubleshoot your networking. To make this easiest, set all virtual networks to Bridged mode.

On both computers, execute this command:

ping google.com

Make sure you are getting replies on both machines.

Downloading Cookie-Cadger

On your Kali Linux machine, execute this command:

wget https://www.cookiecadger.com/files/CookieCadger-1.08.jar

Troubleshooting
If that link doesn't work, use this command:
wget https://samsclass.info/123/proj14/CookieCadger-1.07.jar --no-check-certificate

Running Cookie Cadger

On your Kali Linux machine, execute this command:

java -jar CookieCadger-1.07.jar

A bob pops up asking "Enable Session Detection?". Click No.

The main Cookie Cadger window opens, as shown below. Click the "Start Capture on eth0" button.

On your Target machine, NOT the Kali Linux machine, open a Web browser and visit this site:

http://www.msn.com

A MAC address should appear in Cookie Cadger, as shown below. Click it to see the domains used to load that page.

On your Target machine, NOT the Kali Linux machine, open a Web browser and visit this site:

http://attack.samsclass.info/cookielogin

A Message Board opens, as shown below. Notice the "Welcome" message, showing that you are logged in.

In the Message Board, click the "Erase Comments" button.

Type your name into the Comment field and press Enter.

A page should appear, showing your name in a comment, as shown below.

Capturing a Cookie with Cookie Cadger

In Cookie Cadger, in the domain list, click attack.samsclass.info

In the Cookie Cadger window, in the third column, click /cookielogin/messageboard.php, as shown below.

The messageboard.php item may not appear. If that happens, try refreshing the page on the Target machine, and opening another tab to visit another site such as msn.com or yahoo.com.

Unfortunately, Cookie Cadger is a bit slow to respond and buggy, like other Java applications.

Saving the Screen Image

Make sure you can see these two items:

attack.samsclass.info
/cookielogin/messageboard.php

Save a FULL DESKTOP image with the filename Proj 11a from Your Name.

Performing a CSRF Attack

In Cookie Cadger, click "Replay Request".

The message board opens in Kali, showing the Welcome message, indicating that you are now authenticated.

Testing GAMES.SAMSCLASS.INFO

Repeat this process on this target URL:

http://games.samsclass.info/cookielogin

Does CSRF work on this site?

Explain Your Results

WRITE AN EXPLANATION into the body of your email message. Say whether games.samsclass.info/cookielogin is vulnerable to this attack, and explain why.

Turning in Your Project

EXPLAIN YOUR RESULTS for games.samsclass.info/cookielogin in the body of your email.

Attach the image to cnit.123@gmail.com with a Subject line of Proj 11 from Your Name.

Last modified 2-6-15 9:53 pm