Web13: Session Hijacking Hacking Techniques

1. Cause

This guide provides a clear overview of session hijacking, including 1. Cause, 2. Mining Ways. Use it to understand the topic, compare the available options, and make a more informed decision.

2. Mining Ways

Session Sniffing

As we can see in the figure, first, the attacker will use a sniffer tool to capture the valid session ID of the victim, then he uses this session ID to work with the Web Server under the victim's authority.

Cross-Site Script Attack

An attacker can obtain the victim's session ID by means of malicious code that runs on the client side, such as JavaScript. If a website has an XSS vulnerability, an attacker can create a link containing malicious JavaScript code, and send it to the victim. If the victim clicks on this link, his cookie will be sent to the attacker.

3. Prevention

The following methods can be used to prevent Session Hijacking:

• Use HTTPS in data transmission to avoid eavesdropping.
• Use a large random string or number to limit the success of a bruteforce attack.
• Regenerate session ID after each user successfully login, to avoid Session Fixation attack.

Wish you get more knowledge after each lesson with TipsMake.com!

Conclusion

Understanding Session Hijacking makes it easier to compare options, avoid common mistakes, and apply the information in this guide more effectively. Review the relevant requirements before making changes or choosing a solution.