Description

Identifies sensitive cookies in HTTP responses that are missing the 'Secure' flag attribute. When sensitive cookies lack this flag, they can be transmitted over unencrypted HTTP connections, making them vulnerable to interception and theft by attackers through man-in-the-middle attacks.

Detection Strategy

• Examines Set-Cookie headers in HTTP responses

• Checks if cookie names match known sensitive patterns (e.g., session, auth, token)

• Reports a vulnerability if a sensitive cookie is found without the 'Secure' flag set