Cookie Theft & Session Hijacking

A session cookie is a bearer token: whoever holds it is the user. Modern adversary-in-the-middle (AiTM) phishing kits increasingly steal the session cookie rather than the password, sidestepping MFA entirely.

How it works

• XSS: script on the page reads a non-HttpOnly cookie or token and exfiltrates it.
• AiTM proxy: a reverse-proxy phishing kit (Evilginx-style) relays the real login — including MFA — and captures the resulting session cookie.
• Network/host: cookies sent without Secure over HTTP, or read from logs/backups.

The stolen cookie is replayed from the attacker's browser to resume the authenticated session.

How to test

Check whether session cookies are HttpOnly + Secure, whether tokens are exposed to JS, and whether a session is bound to anything beyond the cookie (device, client fingerprint). Replay a captured cookie from a different IP/agent to see if it's accepted.

Impact

Full account access that bypasses passwords and MFA, persisting until the session is revoked.

Defenses

• HttpOnly, Secure, SameSite cookies; eliminate XSS.
• Token binding / device-bound sessions; re-auth for sensitive actions.
• Short session lifetimes, server-side revocation, and anomaly detection on replays.