> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/ewptxv3-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/ewptxv3-notes/readme/5.5-other-common-web-attacks/5.5.1-session-attacks/6.2.3-session-hijacking-via-cookie-tampering.md).

# 6.2.3 Session Hijacking via Cookie Tampering

## **Cookie tampering**

{% embed url="<https://www.geeksforgeeks.org/cookie-tampering-techniques/>" %}

**Cookie tampering** is a method in which the attacker manipulates or modifies the information of the stored data on a web browser. This includes all types of data like personal information (name, number, address), and credentials for certain websites, or it can be the settings for specific websites. it is intended to steal valuable information from users.

We can capture a cookie (usually encoded in Base64) using Burp Suite,&#x20;

<figure><img src="https://content.gitbook.com/content/RpANgsg91cAWGMlAJ255/blobs/NEK8evtsl7JDIdJR4vP2/image.png" alt=""><figcaption></figcaption></figure>

and decode it in plain text using Decoder:

<figure><img src="https://content.gitbook.com/content/RpANgsg91cAWGMlAJ255/blobs/d2h66rkpsq4sH82ciuqp/image.png" alt=""><figcaption></figcaption></figure>

Seeing it, we quickly understand that we're log in, and we've not admin permission, then we can change value of admin to 'True' and encoding again it in Base 64:

<figure><img src="https://content.gitbook.com/content/RpANgsg91cAWGMlAJ255/blobs/4KHYfrwsUVfuuVpB1tMR/image.png" alt=""><figcaption></figcaption></figure>

Now that we've setted session id with admin privileges, we can use repeater to use this custom session id value and login in into privileged account.

<figure><img src="https://content.gitbook.com/content/RpANgsg91cAWGMlAJ255/blobs/hRFhjWsYSbDgXZKcwxxX/image.png" alt=""><figcaption></figcaption></figure>