Posts Tagged ‘Session Hijacking’

Session Hijacking

Session hijacking is the act of taking control of a user session after successfully obtaining or generating an authentication session ID. Session hijacking involves an attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user’s Web application session while that session is still in progress.

Types of Session Hijacking

There are two types of session hijacking attacks:

Active: In an active attack, an attacker finds an active session and takes over

Passive: With passive attack, an attacker hijacks a session, but sits back, and watches and records all the traffic that is being sent forth.

Session Hijacking Attacks:

Attackers’ use several session hijacking attacks to gain access to user sessions on a server, the most common of these attacks are listed below:

  • Session Prediction
  • Session Sidejacking
  • Session Fixation
  • Cross Site Scripting
  • Using Proxy Servers
  • Physical Access to Server

Defending Against Session Hijacking

Since session hijacking is where the attacker steals a user’s Session Identifier, to prevent this attack, we would need to prevent the user’s Session Identifier. There are several things we can do to help to prevent this attack:

  1. Use Secure Connections (Achieved through Secure Socket Layer(SSL) – as much as possible, since SSL creates an encrypted connection between the client and server, any data the attacker steals during this transfer would be useless to them. However, SSL does not fully secure against this attack, and hackers can still use session hijacking even over HTTPS.
  2. Regenerate user’s session identifier often, therefore, even though the attacker may manage to steal a user’s session identifier, when it is regenerated, the Session Identifier he stole would be useless.
  3. You can implement an IP Address Check to match a user’s Session Identifier to his/her IP Address. However this may have its limitations.
  4. Another method is to use HTTP only cookies, these are cookies that claim to be inaccessible from the DOM, However, some hackers have claimed to gain access to HTTP only cookies through the dom. HTTP only cookies would still make it harder to gain access to cookies using most of the session hijacking attacks. However if session Sidejacking is used, These cookies can easily be stolen from over a LAN network. Session Sidejacking is spoofing cookies over a LAN network,


Read Full Post »

Sessions Hijacking

Social Media Facebook and Twitter is popular and widely adopted. For this article would like to share on one ID security risk that is so common for people make use of public WiFi to access their private social media account (actually it work for all the web access page submit user ID and password).

Everything I hangout at the Coffee Shops, will noted that most of people will make use of the Public WiFi to access to social media website. Most of people do not have security awareness and aware that share public WiFi is connected with all sort of people.

Below live video demonstrate is base on the scenario on the public WiFi, session hijacking can be do as easy as just auto scan and pick a victim. Please spend few minutes for the full video and get the lesson.

E-SPIN is partner with Immunity to distribute their SILICA wireless penetration testing tool set (come with wireless injector adapter, signal booster, USB boot SILICA wireless to perform wireless security assessment, penetration testing or audit). If you or your company look for secure wireless network or Access Point (AP), or consult on the wireless security assessment, penetration testing or ethical hacking, feel free to contact E-SPIN for assistance.

E-SPIN is specialize in the end to end vulnerability management, security assessment, penetration testing and ethical hacking system and point solutions, and active in serving partners, enterprises, governments and military clients.

Read Full Post »