Glossary
Cookie injection
Writing a saved set of cookies into a fresh browser profile so it opens already signed in, without the password being entered.
Also called: session import, cookie import.
Cookie injection means loading a previously saved set of cookies into a browser profile before it navigates anywhere, so the site it visits sees an established session and the profile opens signed in. It works because a session cookie is the proof of authentication — the password produced it, and afterwards the site checks the cookie rather than the password, which is also why a session usually survives a page reload without a second factor being asked for again.
That property cuts both ways and is worth being blunt about. Used on your own sessions it removes the worst habit in this industry: whoever is on shift opens the account without being told the password and without the two-factor codes going to their phone. Used on somebody else's stolen cookies it is session hijacking, which is unauthorised access however the cookies were obtained. The defensive consequence is that a saved session must be treated exactly like the password, because it is worth the same. In Argus a saved session is a cookie set: stored in your workspace, assignable to any profile, and seeded into the session at launch.
More from the glossary
Headless browser
A real browser engine run without a visible window, usually under automation. Cheap to run at volume, and increasingly easy for a site to spot.
CAPTCHA solving
Passing a challenge to a third-party service that answers it. Useful occasionally, and a poor substitute for not triggering the challenge.
Timezone and geolocation spoofing
Making a browser report a clock — and sometimes a position — that matches where the session claims to be rather than where the machine is.
Anti-detect browser
A browser built to run many separate identities on one machine, each with its own storage, device characteristics and network address.
Browser fingerprint
The set of properties a page can read about your browser and machine in a few milliseconds, without permission, which together identify the device.
Canvas fingerprint
An identifier derived by asking the browser to draw a shape or a line of text and hashing the exact pixels that come back.
Every entry is listed on the glossary index.