Technique
№ 020 · class: privileges
Access Token Manipulation
Token abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.
Term
description · examples · notesToken abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.
Description
This technique bypasses conventional authentication because tokens represent an already verified identity. It is especially dangerous in single sign-on environments where one token grants access to many resources.
Examples
- Stealing an OAuth token from browser storage via a malicious extension
- Intercepting a session cookie on an unprotected wireless network
- Extracting an access key from a configuration file on a compromised server
Notes
- Short token lifespans and device-bound tokens are effective protective measures.
Threats
used by 2Threats that use it. Select one to open its page.
Defenses
countered by 4How it is countered. Select one to open its page.