The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

If an application explicitly liberalizes its cookies’ scope to a parent

domain or parent directory, then it may be leaving itself vulnerable to

attacks via other web applications.

■

If an application sets its cookies’ domain scope to its own domain name

(or does not specify a domain attribute), then it may still be exposed to

applications or functionality accessible via subdomains.

■

If an application specifies its cookies’ path scope without using a trailing

slash, then it might be exposed to other applications residing at paths

containing a prefix that matches the specified scope.

Identify all of the possible domain names and paths that will receive the

cookies issued by the application. Establish whether any other web application

or functionality is accessible via these domain names or paths that you may be

able to leverage to obtain the cookies issued to users of the target application.