Which attacks occur when a cookie is sent from the client side to the server?

Which attacks occur when a cookie is sent from the client side to the server?

• A. SQL Injection Attacks
• B. Cookie Tampering
• C. Web Server Misconfiguration
• D. Directory Traversal Attacks

Answer: (B)

Cookies travel from the client to the server with each request, and if a value stored in a cookie is trusted by the server without verifying its integrity, an attacker can modify that value before it’s sent back. This is what cookie tampering is: the client alters the cookie’s content to change what the server believes about the user or their permissions, potentially gaining higher privileges or accessing data they shouldn’t. Other options don’t fit because SQL injection targets server-side database queries by injecting SQL through input fields, not through cookies, and directory traversal attacks exploit file path handling to access files, not cookie values. Web server misconfiguration refers to issues in how the server is set up rather than the client altering cookies. To prevent cookie tampering, store critical state on the server (rather than trusting client-side cookies for authorization), sign or encrypt cookies so their contents can’t be modified without detection, and use secure attributes like HttpOnly and Secure to reduce exposure. Validation of cookie values on the server side is essential to ensure integrity and authenticity.

Cookies travel from the client to the server with each request, and if a value stored in a cookie is trusted by the server without verifying its integrity, an attacker can modify that value before it’s sent back. This is what cookie tampering is: the client alters the cookie’s content to change what the server believes about the user or their permissions, potentially gaining higher privileges or accessing data they shouldn’t.

Other options don’t fit because SQL injection targets server-side database queries by injecting SQL through input fields, not through cookies, and directory traversal attacks exploit file path handling to access files, not cookie values. Web server misconfiguration refers to issues in how the server is set up rather than the client altering cookies.

To prevent cookie tampering, store critical state on the server (rather than trusting client-side cookies for authorization), sign or encrypt cookies so their contents can’t be modified without detection, and use secure attributes like HttpOnly and Secure to reduce exposure. Validation of cookie values on the server side is essential to ensure integrity and authenticity.