id: cookie-injection

info:
  name: Parameter based cookie injection
  author: pdteam
  severity: info
  reference:
    - https://www.invicti.com/blog/web-security/understanding-cookie-poisoning-attacks/
    - https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_injection.htm
  metadata:
    max-request: 1
  tags: reflected,dast,cookie,injection

variables:
  first: "cookie_injection"

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      reflection:
        - "{{first}}"

    fuzzing:
      - part: query
        type: postfix
        fuzz:
          - "{{reflection}}"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)(?i)(^set-cookie.*cookie_injection.*)'
# digest: 4b0a004830460221008d176a937df3a060c869460001cd09392d40a6b967ff6e96f370720d962326d4022100d97bad09822dfe1eb276af89d02ed901100fe7b826d4acd9b4d9a363c899f74b:922c64590222798bb761d5b6d8e72950