29 WebApp Labs Introduction

© 2018 Caendra, Inc.
| Hera for PTP | WebApp Labs - Introduction 1

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 2
In these Introduction labs, the student will learn some basic concepts on Same Origin
Policy and Cookies. Few different web applications are available to the student in order to
test and practice different implementations.
Once you are connected in VPN, you have to configure 10.100.13.37 (the lab DNS server)
as your first DNS resolver:
• WINDOWS: Change the IPv4 property of the TAP network device, adding 10.100.13.37 as the
first DNS server in the DNS settings.
• LINUX: Prepend an entry to the /etc/resolv.conf file with the IP address of the lab DNS server
10.100.13.37, ensuring it is the first nameserver listed.
You are now ready to open the following URL: http://info.introduction.site/ or navigate
http://10.100.13.37.
There are two types of lab: Video, Lab.
• Video section contains web applications used during video lessons. Therefore, if
you need any information about the scenario, the attacks and so on, please refer to
the corresponding video.
• Labs section contains web application where you can practice the techniques of the
specific module and have solutions. You can find them later in this manual
The main goal of these labs is to understand how the Same Origin Policy and Cookies work.
Navigate the web application and inspect how they behave.
The best tool is, as usual, your brain. Then you may need:

• Web Browser
• Firebug or a cookie inspector plugin
In order to test the cookie lab you will have to log into the application. Credentials are
already stored in the form. You can login by clicking on the “Sign in” button.

All the web applications contain a login page that the student can use to access the web
app. Notice that the forms are already filled with the correct credentials to log in, so you
just need to click on "Login".
As soon as you access the web application, depending on the web application, cookies will
be set with different configuration.
Log into the web applications and inspect the cookies: navigate different pages, domains
and subdomains in order to check when and where the cookies are sent.
• How cookies work depending on how they are set

Please go ahead only if you are really stuck or if you have
completed the labs

Once you click on the login button, the web application sets the following cookie:
• Name: TestCookie
• Value: Cookie set by default
• Domain: a.correctcookie1.site
• Path: /
• Expires: Session
The code that the application uses is the following:
setcookie("TestCookie", "Cookie set by default");
As you can see, everything is set by default, except the name and the cookie value. This
means that the cookie will only be sent to:
• http://a.correctcookie1.site/*
• https://a.correctcookie1.site/*
You can now test when the cookie is sent, by clicking on the links displayed in the page.
• Different path: the cookie is sent.

• Different subdomain: the cookie is not sent
• Different domain: the cookie is not sent

• Value: Cookie set to correctcookie2.site
• Domain: .correctcookie2.site
• Path: /
setcookie("TestCookie", "Cookie set to correctcookie2.site",

null, null, "correctcookie2.site");
As you can see, the domain has been set to correctcookie2.site. This means that the cookie
will only be sent to:
• http://correctcookie2.site/*
• https://correctcookie2.site/*
• http://*.correctcookie2.site/*
• https://*.correctcookie2.site/*

• Different subdomain: the cookie is sent

• Value: Cookie set to /test/
• Domain: a.correctcookie3.site
• Path: /test/
setcookie("TestCookie", "Cookie set to /test/", null, "/test/");
As you can see, the path has been set to /test/. This means that the cookie will only be
sent to:
• http://a.correctcookie3.site/test/*
• https://a.correctcookie3.site/test/*

• Different subdomain: the cookie is not sent

• Value: Cookie value set to A for .correctcookie4.site
• Domain: .correctcookie4.site
• Path: /
setcookie("TestCookie", "Cookie value set to A for

.correctcookie4.site", null, null, ".correctcookie4.site");
As you can see, the domain has been set to correctcookie4.site. However, what
happens if the parent domain (correctcookie4.site) tries to set a cookie with the
same value?
To test this, you can click on "Set a new cookie from correctcoockie4.site". This is the code
used by the web application (correctcookie4.site/setnewcookie.php):
setcookie("TestCookie", "Cookie value set to B with a default

domain");
As you can see, now you have two cookies with the same name. Note that these two cookies
are different (inspect the domain value set).

The following web application does not set the cookie properly. Indeed once you click on
the login button, the web application sets the following cookie:
• Value: Cookie set for a.incorrectcookie.test
• Domain: .a.incorrectcookie.test
• Path: /
setcookie("TestCookie", "Cookie set for

a.incorrectcookie.test",null,null, "a.incorrectcookie.test");
As you can see, the domain has been set to a.incorrectcookie.test (but we are
navigating incorrectcookie.site).
This is not going to work since a.incorrectcookie.site cannot set a cookie for a
different domain (such as a.incorrectcookie.test). Indeed if we click on "Test
cookie on a.incorrectcookie.test", we can see that no cookie is set.

The following web application does not set the cookie properly. Indeed once you click on
the login button, the web application sets the following cookie:
• Value: Cookie set for b.incorrectcookie2.site
• Domain: b.incorrectcookie2.site
• Path: /
setcookie("TestCookie", "Cookie set for

b.incorrectcookie2.site",null,null, "b.incorrectcookie2.site");
As you can see, the subdomain has been set to b.incorrectcookie2.site (but we are
navigating a.incorrectcookie2.site).
This is not going to work since a.incorrectcookie2.site cannot set a cookie for a
subdomain (such as b.incorrectcookie2.site). Indeed if we click on "Test cookie on
b.incorrectcookie2.site", we can see that no cookie is set.

29 WebApp Labs Introduction

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

29 WebApp Labs Introduction

Uploaded by

Copyright:

Available Formats

© 2018 Caendra, Inc.

| Hera for PTP | WebApp Labs - Introduction 1

There are two types of lab: Video, Lab.

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 3

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 4

• How cookies work depending on how they are set

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 5

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 6

The code that the application uses is the following:

setcookie("TestCookie", "Cookie set by default");

• Different path: the cookie is sent.

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 7

The code that the application uses is the following:

setcookie("TestCookie", "Cookie set to correctcookie2.site",

• Different path: the cookie is sent.

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 8

The code that the application uses is the following:

setcookie("TestCookie", "Cookie set to /test/", null, "/test/");

• Different path: the cookie is sent.

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 9

The code that the application uses is the following:

setcookie("TestCookie", "Cookie value set to A for

setcookie("TestCookie", "Cookie value set to B with a default

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 10

The code that the application uses is the following:

setcookie("TestCookie", "Cookie set for

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 11

The code that the application uses is the following:

setcookie("TestCookie", "Cookie set for

© 2018 Caendra, Inc. | Hera for PTP | WebApp Labs - Introduction 12

You might also like