id: cookie-injection

info:
  name: Parameter based cookie injection
  author: pdteam
  severity: info
  reference:
    - https://www.invicti.com/blog/web-security/understanding-cookie-poisoning-attacks/
    - https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_injection.htm
  metadata:
    max-request: 1
  tags: reflected,dast,cookie,injection,vuln

variables:
  first: "cookie_injection"

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      reflection:
        - "{{first}}"

    fuzzing:
      - part: query
        type: postfix
        fuzz:
          - "{{reflection}}"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
# digest: 4a0a00473045022012d1757b00fc5a6f9ee4c883ae5413e0bd3973591b56ba0a5e79bc72b76f47cb022100c3719ad78ef3de245f1263e87dc46c710215231d1b04abed19543b0c6c520ed1:922c64590222798bb761d5b6d8e72950