I have an assignment for a client with an audit showing there was a vulnerability regarding cookie hijacking. They have a session cookie made by MS Ecommerce Server, and the cookie stores an email address as its ID -- or at least as part of its id -- below is an example of what it looks like when displayed in fidder: "MSCSAuth","Ticket%3Dmike2%40test%2Ecom%2539663%2E880335648+3%3B".
The problem we are protecting against, and that i would like to duplicate, would occur when a user has an authenticated session, and then they change the email address which is in the ID. So that signed in as "Mary@abc.com," they change to "stealingFromMary@stealing.biz". Then, they could gain access to the new email addresses account.
I think this whole thing is bunk because, I doubt that you can change an active session, and still be logged in. I have made my own site, created a "MSCSAuth" cookie with the value of an existing s ...
Go to the complete details ...