Stealing Web Session Cookies to Bypass MFA (Credential Access)

In this video we'll be exploring how to attack, detect and defend against the theft of session cookies. A session token acts like a temporary password, meaning this technique can be used by an attacker to gain access to applications by bypassing the logon process altogether - including any multi-factor authentication steps.

If you find the video useful please do give it a like, and consider subscribing if you want more of this sort of content. Drop a note in the comments if there’s anything you think I missed, or if you have a good idea of what topic I should cover next.

Further reading/watching:

Audio Credits (licensed under CC0):

Timestamps:
0:00 Intro
1:43 Attack
3:38 Detect
6:08 Defend

[pavansrivatsavakula]

Andy, Thanks a lot for making this video. The detailed explanation helped me understand more clearly. The idea of Attack, detect, defend is extraordinary. This is how we need to learn the security concepts(3D view). Please make more videos, you will soon reach good heights. All the best!!✌

[bernardesk]

This video will help me test a two-factor authentication system for accessing servers and network equipment in an environment, thank you very much.

[ehasaranga]

Thanks for the knowledge. Was looking for this explaination for a while now.

[Nika]

Explained so well; this is some quality ass video.

Edit: subbed for sure

[ptsai]

Great video. This helps me on MFA requirements.

[muralimohan]

Great content.
Please do more videos in this series.

[paulstubbs]

It would be nice if websites gave the user the ability to enable the mitigations as shown here, for instance I'd be mostly fine if I have to re-login on IP address changes. I'm a residential user, so yes my address does change, but not that often.
Actually that would be a lot less of a pain than the two factor authentication stuff being forced on me, as in their version with no options.

[joelitle]

Thanks for video, bro you are the best!!!

[DestoFlix]

I was speaking about this in theory with a more experienced hacker and they were skeptical that its possible. I told them mfa in some sites wont be sus of the new ip

[BlokeBritish]

gud 1 Andy boy. i wonder why most web security channels are mostly by Americans.
what the heck r the other Brits doing ?
Im Indian and I need more Brit tutorials please

[impro]

What if the website set a particular time for a session to end due to inactivity

[amanaggarwal]

Hi Andy, Do we have something to store the physical address of machine? That can solve our issue as IP is a dynamic thing and can hackers can clone the IP or mac address too??

[showbikshowmma]

my brother, one big question I wanna ask you freely. For example in my webapp people sign up their accunt. After that from their cookie as a admin can i check beisde my webapp what other website like what other thing they are browsing from their browser? I am asking this question to see user perferense which will help us to show them their preferense ads based on their browser search history . how can I do this thing? Facebook is already being collecting our whole browsing data from cookie.

[MrDavi]

Andy, would it be secure, in this case, using a password manager + erase cookies in every session?

[tam]

so would logging out of an account mean the session token will be different every time you log in? just clarifying cuz im a bit anxious abt one of my accounts 😭

[denverm]

Hi, please, if we think the cookies get hacked, what we do? please, thanks

[-zerocool-]

Why arnt local cookies stored encrypted?

[Grimzys]

thank you soooo much i cookie logged on roblox and made 500 usd worth of

[projectjinc.]

this help me hack my hacked account back