Which attack involves reading cookies on a victim's machine to learn user behavior or exfiltrate data?

Which attack involves reading cookies on a victim's machine to learn user behavior or exfiltrate data?

• A. Unvalidated Redirects and Forwards
• B. Cookie Snooping
• C. Deserialization
• D. Insufficient Transport Layer Protection

Answer: (B)

Reading cookies stored in a user’s browser to learn behavior or exfiltrate data is cookie snooping. Cookies hold small bits of information like session identifiers and user preferences. If an attacker can access these cookies—through weaknesses like cross-site scripting that reads cookies, insecure browser storage, or by sniffing them over an insecure connection—they can infer how a user interacts with the site or impersonate the user by using the stolen session token. To reduce risk, cookies should be protected with HttpOnly (so client-side scripts can’t read them), Secure (transmitted only over HTTPS), and, where appropriate, SameSite to limit cross-site requests; minimize sensitive data in cookies and rely on server-side session handling. Unvalidated Redirects and Forwards is about redirecting users to other sites, not about cookie access. Deserialization involves converting serialized data back into objects for potential code execution. Insufficient Transport Layer Protection concerns interception of data in transit, which can lead to cookie theft, but the scenario described specifically matches reading cookies on the victim’s machine.

Reading cookies stored in a user’s browser to learn behavior or exfiltrate data is cookie snooping. Cookies hold small bits of information like session identifiers and user preferences. If an attacker can access these cookies—through weaknesses like cross-site scripting that reads cookies, insecure browser storage, or by sniffing them over an insecure connection—they can infer how a user interacts with the site or impersonate the user by using the stolen session token. To reduce risk, cookies should be protected with HttpOnly (so client-side scripts can’t read them), Secure (transmitted only over HTTPS), and, where appropriate, SameSite to limit cross-site requests; minimize sensitive data in cookies and rely on server-side session handling.

Unvalidated Redirects and Forwards is about redirecting users to other sites, not about cookie access. Deserialization involves converting serialized data back into objects for potential code execution. Insufficient Transport Layer Protection concerns interception of data in transit, which can lead to cookie theft, but the scenario described specifically matches reading cookies on the victim’s machine.