4 ms·
To expand on your second point, if you have 3, then in many cases you also have the ability to intercept and modify non-encrypted traffic. Meaning, if the victi
by ivanr 14y ago
To expand on your second point, if you have 3, then in many cases you also have the ability to intercept and modify non-encrypted traffic. Meaning, if the victim is using a secure web site and a non-secure site at the same time, the MITM can infiltrate the non-secure site and use it to generate requests to the secure site.
- xhrpost 14y agoI think you're correct here but how would you manipulate the cookies being sent when sending XSS requests from a different domain?
- cstejerean 14y agoyou don't need to manipulate the cookies being sent, only the body of the message. The browser will send the correct cookie in the header, you control the body, and use the length of the message to determine how close the cookie value in the body is getting to the one in the header.
- ivanr 14y agoFor CRIME, I don't think that it's necessary to control the cookies. Having control of other parts of the request should be sufficient (e.g., using request headers, request body, etc). As for manipulating cookies from the MITM perspective, here's one clunky way to do it: redirect the victim's browser to the plain-text version of the target web site, intercept that request, and set a new cookie (pretending to be the plain-text version of the target web site). The next request to the secure version of the target web site should contain the injected cookie. As tptacek mentioned in another comment, this approach would not work with a site that uses HTTP Strict Transport Security.
- tptacek 14y agoThe attack as Pornin outlines it does not involve controlling the cookie header, but rather on being able to get content into the client's TX stream that happens to match the cookie header; think in terms of things like query args and post data. I think all three comments in this little subthread might be saying the same thing. Go nerddom!
- tptacek 14y agoThat's why sites need to enable the Secure flag on their cookies, and to set the Strict-Transport-Security headers.
- thatwonthelp 14y agoWon't help in this case.
- tptacek 14y agoI don't know what you're saying. If you're saying that the "Secure" flag won't defend against CRIME, nobody is saying that. I'm saying that the "Secure" flag and HSTS mitigates SSL-stripping.
- bdr 14y agoOddly, GP's account was made for the purpose of writing that comment. I'm unsure what that means.
- tlrobinson 14y agoI think both ivanr and thatwonthelp were suggesting that any non-secure site (same origin or not) can be hijacked in order to make the requests necessary for this attack. I understand and agree with your comment about the secure flag, but if I understood ivanr's comment it doesn't apply.