Web Security: Common Vulnerabilities And Their Mitigation - Session ids using hidden form fields and cookies

The video tutorial explores various methods of transmitting session IDs, including URL parameters, hidden form fields, and cookies. It highlights the impracticality of certain attacks, such as using hidden form fields, and explains how cookies are the standard method for session ID transmission. The tutorial also covers cross-site scripting, domain-level cookies, meta tags, and header injection as techniques for setting session IDs, emphasizing the challenges and risks associated with each method.

Why is using URL parameters to pass session IDs considered insecure?

• They are not supported by all browsers.

• They require special software to decode.

• They are too long to be practical.

• They can be easily intercepted by attackers.

What is the most common method of passing session IDs to clients?

• Cookies

• Email links

• Hidden form fields

• URL parameters

How can cross-site scripting be used in relation to cookies?

• To inject JavaScript that sets cookies

• To encrypt cookies

• To delete cookies

• To change the cookie expiration date

What is a subdomain in the context of setting cookies?

• A domain that is only accessible internally

• A domain that is part of a larger domain

• A smaller version of a domain

• A domain that cannot set cookies

Which method allows an attacker to set a session ID in a cookie by targeting the server?

• Injecting a header into the response

• Using a meta tag

• Modifying the URL parameters

• Changing the HTML form action