Hacking UBB with Cookies
This demonstration shows why you should avoid using cookies on a public computer. Make sure that all of your information is deleted someone can not do the following:
As I said earlier today I wanted to have some cookie fun. Well I opened up the cookie jar and pulled out a little tidbit of information. I found an interesting program called Cookie Editor and made my job a lot easier!
So I grabbed the cookie from a forum that I visit on a regular basis with my original screen name. The cookie stores my information so it knows who I am so I do not have to keep logging in. I copied the user id and the password fields into notepad.
I logged out of the forum and I went to my internet options and deleted all of my stored files and cookies to make sure that my original cookie was deleted. I logged back into the forum under another name that I got for testing purposes.
I then went back to the Cookie Editor and looked for the new forum cookie and you can see that the information changed.
I replaced the user id value with the other name.
I replaced the MD5 password hash with the other accounts.
And now you just have to close your browser and reopen the webpage.
You then see that the name has changed! Now you can post under this person’s account. I find this to be a little scary. I tried to do the same thing with hotmail but it did not work, it would change the email account, but would require a password. Over the weekend I might find out some other things but only time will tell.
Have a good weekend and stay out of trouble!
Eric Pascarello HTML/JavaScript moderator at JavaRanch.com
The Loop
How do you keep a programmer in the shower all day?
Give him a bottle of shampoo which says "lather, rinse, repeat."
What I am working on:
I am working on another project with cookies! I am playing with cookies from websites and seeing what I can come up with.
You might be surprised what a person might be able to do with cookies that were left sitting on the temp folder. Hopefuly I will have a nice blog on this on Monday!
Have a good weekend people!
Eric Pascarello HTML/JavaScript moderator at JavaRanch.com