Glossary

Cookie injection

Writing a saved set of cookies into a fresh browser profile so it opens already signed in, without the password being entered.

Also called: session import, cookie import.

Cookie injection means loading a previously saved set of cookies into a browser profile before it navigates anywhere, so the site it visits sees an established session and the profile opens signed in. It works because a session cookie is the proof of authentication — the password produced it, and afterwards the site checks the cookie rather than the password, which is also why a session usually survives a page reload without a second factor being asked for again.

That property cuts both ways and is worth being blunt about. Used on your own sessions it removes the worst habit in this industry: whoever is on shift opens the account without being told the password and without the two-factor codes going to their phone. Used on somebody else's stolen cookies it is session hijacking, which is unauthorised access however the cookies were obtained. The defensive consequence is that a saved session must be treated exactly like the password, because it is worth the same. In Argus a saved session is a cookie set: stored in your workspace, assignable to any profile, and seeded into the session at launch.