Purpose

CFT helps security engineers, privacy auditors, penetration testers, and compliance teams quickly enumerate the cookies a website sets and identify security misconfigurations before attackers do.

What CFT Detects

• Missing Secure attribute — cookie transmittable over HTTP
• Missing HttpOnly — authentication cookies exposed to XSS
• Missing or weak SameSite — CSRF risk
• SameSite=None without Secure — rejected by modern browsers
• Third-party cookies — cross-site tracking domains
• Zombie / fingerprinting cookie patterns
• Session vs. persistent lifespan classification

How It Works

⚡ HTTP Scan (default) — CFT makes a server-side HTTP GET request to the target URL, follows up to five redirects, and captures all Set-Cookie response headers at each hop. Each cookie is parsed and classified against a security rule set. Fast (~2 s), no browser involved.

🔬 Deep Scan (headless) — CFT launches Chromium, crawls up to 10 same-site pages in one browser context, waits for network activity to settle, and captures cookies plus localStorage and sessionStorage key names. When an “Accept all” control is present, CFT records storage before and after consent and labels the state. Results include the origin and first page where each key was detected.

Defender Use Cases

• Pre-pentest recon — map cookie surface before engagement
• GDPR / ePrivacy audit — identify third-party trackers
• Secure SDLC gates — verify cookie hardening before release
• Incident response — check if session cookies lack HttpOnly
• Vendor assessment — audit third-party SaaS cookie posture
• Red team recon — find session cookie weaknesses to exploit

Known Limitations

• HTTP Scan only: misses cookies set by JavaScript after page load — use Deep Scan to capture those
• Neither mode authenticates — misses cookies behind login walls
• Single page per scan — may miss cookies set only on subpages
• Cannot read cookies already stored in your local browser (browser same-origin policy)
• HttpOnly cookie values are never visible — observed via headers (HTTP Scan) or browser context (Deep Scan) but values are always redacted

Privacy Commitment

• Cookie values are always redacted — CFT never logs or stores cookie content
• Scan targets are not retained after the response is returned
• No advertising analytics or tracking pixels are used by CFT
• All scan processing runs on WinCyberScan infrastructure — no data leaves to third parties
• Signed-in accounts use one essential, secure session cookie