Unit 6: HTTP and TLS on the wire · Lesson 1 of 5 · 18 min

HTTP in the clear

Read every request and response of a plain HTTP login and list what anyone on the path could see.

mission

You are
The analyst reviewing the intranet.
Situation
The intranet still answers on plain HTTP port 80. Management asks whether that is a real problem or a theoretical one.
Goal
Show, from http.pcap, exactly what a person on the office network could read.
Hand in
The response code of the login, where it redirects and the session cookie.

The login request on the wire

POST /login HTTP/1.1 ... username=jlee&password=...
  1. 1POSTmethod: send data
  2. 2/loginpath
  3. 3username=jlee&password=...form body, readable by anyone on the path
01

List the requests

HTTP fields have names like http.request.method, http.host and http.cookie. Print them as a table.

analyst@net-lab
tshark -r http.pcap -Y 'http.request' -T fields -e http.request.method -e http.host -e http.request.uri -e http.cookie
GET	intranet.corp.example	/login	
POST	intranet.corp.example	/login	
GET	intranet.corp.example	/dashboard	session=4f1c2a9e

you should see The third request carries the session cookie in clear.

02

List the responses

A 302 response sends the browser elsewhere with a Location header. Here it also hands out the session cookie.

analyst@net-lab
tshark -r http.pcap -Y 'http.response' -T fields -e http.response.code -e http.response.phrase -e http.server -e http.location -e http.set_cookie
200	OK	nginx		
302	Found	nginx	/dashboard	session=4f1c2a9e; Path=/
200	OK	nginx

you should see The cookie has no Secure and no HttpOnly flag.

defender tip Whoever copies that cookie is logged in as the user until the session expires. No password needed.

03

Read the form

Form fields are decoded too. This is the line that settles the management question.

analyst@net-lab
tshark -r http.pcap -Y 'http.request.method=="POST"' -T fields -e urlencoded-form.key -e urlencoded-form.value
username,password	jlee,Lab-Only-Pass-99!

you should see The username and password, readable by anyone on the path.

The fix

Now
listen 80;
Set-Cookie: session=4f1c2a9e; Path=/

Credentials and session in clear.

After
listen 443 ssl;
listen 80;  return 301 https://$host$request_uri;
Strict-Transport-Security: max-age=31536000
Set-Cookie: session=...; Path=/; Secure; HttpOnly; SameSite=Lax

HTTPS only, redirect old links, cookie never sent in clear.

04

Find the session cookie in transit

After login, the browser proves who it is with a cookie. Over plain HTTP, anyone on the path can copy it.

analyst@net-lab
tshark -r http.pcap -Y 'http.cookie' -T fields -e ip.src -e http.request.uri -e http.cookie
10.10.0.23	/dashboard	session=4f1c2a9e

you should see The session cookie is visible on the dashboard request.

defender tip A copied session cookie works without the password or MFA. HTTPS plus the Secure flag keeps it off the wire.

What a defender takes away

  1. 1On plain HTTP, every header, cookie and form field is readable on the path.
  2. 2A stolen session cookie is as good as a password.
  3. 3Redirect to HTTPS, send HSTS and mark cookies Secure and HttpOnly. Then reset what was exposed.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    http.response.code for the responses.

  2. Show hint

    http.location

  3. Show hint

    http.server