Web12: Session Fixation hacking technique

1. Introduction

Session Fixation is a technique that allows hackers to hijack a user's session. This technique takes advantage of the fact that the server does not change the session ID value every time the user logs in, instead it uses a pre-existing session ID. The attack process includes obtaining a valid session ID (possibly by accessing the website), then finding a way for the victim to log in to the website with this session ID, and finally, when the victim successfully logs in. , the hacker will browse the website with his account. The specific scenario is as follows:

Mallory finds a website, such as http://unsafe.example.com, that accepts any session ID from the request without authentication.

Mallory will send Alice an e-mail, which contains the link http://unsafe.example.com/?SID=1234.

Alice goes to http://unsafe.example.com/?SID=1234. Then log in to the website.

Mallory simply goes to http://unsafe.example.com/?SID=1234, and uses the website with Alice's account.

Mallory can use the following methods to set cookies for Alice:

Enclose a script to set cookies

Send HTTP Response packet with Mallory cookie valueSend HTTP Response packet with Mallory cookie value

Use HTML meta tags:

Web12: Session Fixation hacking technique Picture 1

2. Examples

Example 1 – Client-side scripting

Similar to the scenario mentioned above, however, in this case, the Session ID is not passed in the URL but in the cookie. To edit the value of the Session ID in the victim's cookie, the hacker will insert a piece of Javascript:

http://website.kom/document.cookie='sessionid=abcd';

Example 2 - tag

Similar to client-side scripting, but this time the hacker will insert additional tags:

http://website.kon/

Example 3 – HTTP header response

Session ID insertion can also be done by intercepting packets exchanged between the client and the Web application, then inserting the Set-Cookie field into the header.

Web12: Session Fixation hacking technique Picture 2

3. How to prevent

The cause of this error is because the server does not regenerate the session ID after each successful login. Therefore, fixing this error is not difficult, we just need to change the value of Session ID and that's it. In PHP, we use the session_regenerate_id() function to regenerate the session.

form fake http headers

Kareem Winters

Update 28 October 2023

You should read it

May be interested

5 Surprising Disadvantages of Using the Pomodor Technique
the pomodoro technique may seem like a golden ticket to productivity. however, while many people find it effective, the technique does have its drawbacks.
Basic Hack Techniques - Part I
to all of you, to meet the needs of learning in hacking and security, fantomas311 has compiled a set of basic hacking articles and hacking-related articles to introduce you to.
Learn about attacking Man in the Middle - Taking over Session control
in this section, i will show you how to attack session hijacking, along with some theory and how to perform attacks, as well as how to detect and prevent them.
Basic hacking techniques - Part II
if the foot printing is collecting all the information related to the destination organization, scan is a step to determine if the other is usable by ping scans, port scanning and detection tools. automatic
Learn about Ethical hacking using Kali Linux and Raspberry Pi
a raspberry pi 3 runs kali linux for building amazing hacking skills. this small computer is cheap, powerful and very flexible.
Growth Hacking growth strategy - Part 1
along with the development of connectivity technology, there are many ways to help you reach customers, promote your business more easily if you update trends in a timely manner. growth hacking is one of those new business strategies.
Qwinsta (query session) command in Windows
(applies to windows server (semi-annual channel), windows server 2016, windows server 2012 r2, windows server 2012)
Instagram account of a series of famous stars hacked and used as a means of fraud
the popular instagram account of the raid campaign after a period of cooling down has continued to heat up over the past few days.
Basic hacking techniques - Attendance - Part III
assuming that the implementation of steps i and ii failed or the information obtained could not be sufficient to launch an instant attack, the hacker would switch to a method of identifying valid user accounts or unprotected shared resources enumeration is a way to extract valid accounts or resources from the system. in part iii, i will detail the most common methods, and the basic tools of attendance technology - step one
What is the Clean Room technique?
the clean room technique is a process in which a new product is developed by applying reverse engineering to an existing product, so as to avoid patent or copyright infringement.