Cookie Monster: Exfiltrating Data and More, Byte by Tasty Byte

Two security consultants describe a 2018 red team engagement in which the client allowed only HTTPS outbound, routed traffic through an inspection proxy, and ran data loss prevention. The team needed a quick, low-tech way to move a file of sensitive records off the network without drawing attention. They chose ordinary web cookies as the hiding place, since cookie traffic is everywhere and rarely scrutinized in detail.

The first prototype, built in Node behind Apache for TLS, used a PowerShell feeder that encoded the file, split it into chunks, and sent them as cookie values over normal GET requests with a spoofed user agent and randomized delays. A server reassembled the data. It evaded the controls, but the odd formatting would stand out to anyone reading closely. The second version added device identifiers, padding, retries for lost chunks, a web interface, configurable headers and cookie sizes, and a heartbeat that polls the server for a single command. The live demo showed a file arriving intact while the proxy saw what looked like routine browsing.

The presenters were candid about limits. Transfers need many requests, encoding inflates file size, and a fresh destination can be caught by reputation filtering. Cookies sent before any server set them could also trigger false positives. Defenders were pointed toward behavioral baselines: what normally talks to where, and which destinations or traffic patterns are new. They invited others to test the tool, since it had not yet been proven against a monitored network.