Session Hijacking

Article Info

Contributed by
2 authors

Last updated on
2022-03-31 08:16:26

HTTP Cookie
Cross-Site Scripting
Transport Layer Security
Secure Sockets Layer
Network Security
Information Security Principles

Article Versions

9 2022-03-31 08:16:26
3605,3600 9,3605

By arvindpdmn

Publishing. Article can be improved later.
8 2022-03-31 04:33:50
3600,3598 8,3600

By techlady

Edited according to all the comments.
7 2022-03-30 11:34:38
3598,3560 7,3598

By techlady

Edited according to all the comments.
6 2022-03-17 05:18:14
3560,3516 6,3560

By techlady

Edited
5 2022-03-08 07:55:20
3516,3515 5,3516

By arvindpdmn

Updating See Also. Improving grammar in questions.

Chat Room

Submitting ...

You are editing an existing chat message.
2022-03-20 03:35:10
-

By arvindpdmn

Change desc for each edit should be descriptive of that particular edit. Just like Git commit messages, these help in quickly tracking article changes.
2022-03-19 08:59:42
-

By arvindpdmn

1. First question is asking two different things.
- Focus only on the example. When explaining the example, cookies should be introduced. Right now it looks like answer is covering two separate ideas.
- Example: repeating previous review comment: talk about cookies, Justin's session and attacker's session. Also, improve the order: a little hard to understand the flow since first sentence says "receives an email" and second sentence says "sends the email".
2. "The session ID, a lengthy random": sentence is not grammatically correct. "Installing..." has similar problem. "Prevention of clicking...": convert to verb form to make the sentence more readable.
3. Noted the updates to active/passive answer. Answer has only one cited source. Need another equally good source. Moreover, since the current cited source has 68 pages, including in citation the exact section or page number.
4. TCP(Transmission Control Protocol): include space before (). Likewise to other abbreviations in the article.
5. OWASP source and relevant info from that source not captured. Consider these sources pointed out by another author:
- https://owasp.org/www-community/attacks/Session_hijacking_attack
- https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
6. References and Further Reading: correct the formatting. Add missing details. Refer to Author Guidelines and other published articles.
7. Further Reading: these should include links that author can read for deeper discussion. "BBC News" doesn't belong here because it's a short article discussing a narrow aspect of SH.
2022-03-08 11:51:36
-

By arvindpdmn

1. Good improvement from previous review. Comments not implemented from previous review: 7, 10, 18 (first two points), 21 (requires shortening the answers).
2. Two earlier good refs have been removed: Bugliesi et al., and Eggleston and Hansen. The previous comment was to improve the formatting and URLs, not delete them.
3. Milestones are better now but can be improved.
4. Summary
- description of session can be better. We don't want to focus on the fact that a session is temporary. It's more important to convey that session establishes identity and context for a series of message exchanges. Citation is needed for such a definition.
- Second para is well written.
- Unusual to include an example in Summary but example is good. I think the example can be expanded and moved to a new question. This can even be the first question. When explaining the example, talk about cookies, Justin's session and attacker's session. Also, improve the order: a little hard to understand the flow since first sentence says "receives an email" and second sentence says "sends the email".
5. Cookie hijacking
- cookie hijacking is an example of application level SH: can merge this detail into levels question
- better still, merge this into the example question noted above
6. Active/passive
- image caption: since question is about active/passive, change caption to "An example of active session hijacking".
- I am not convinced by the explanations of active/passive/hybrid. The cited source Kamal has plenty of grammar and spelling errors. Doesn't look like a good ref. The paper also doesn't give citations for active/passive/hybrid. We need a better source. It may be that there's no common industry definition of what's active/passive/hybrid. At least, we should have 1-2 good references before we can answer this question. Slide 5 of http://cs3.calstatela.edu/~egean/cs5781/lecture-notes/CEHv9/Ch12.pdf gives a very simple explanation of active vs passive but its too brief and lacks details.
6. Levels: explanation can be improved
- make it explicit that hacks TCP and UDP layers are network SH, and hack at HTTP layer via cookie is application SH.
- highlight differences between TCP, UDP and HTTP
7. Prevention
- "The session key is a lengthy random number": stated as a fact. It should be rephrased as a best practice or recommendation. The same problem is there in the next sentence.
- "Avoiding much use of public Wi-Fi": general note but not particular to SH. Remove this.
- not clear which are client-side and which are server-side prevention techniques
2022-03-06 13:25:10
-

By techlady

Thank you @arvindpdmn and @ajithkumardas for your review and suggestions.
2022-03-01 13:36:31
-

By arvindpdmn

Just a reminder to the author. See review comments given earlier.

Session hijacking. Source: Tuit.

A session is an interactive information exchange between two or more communicating devices, or between a computer and a user, in computer science and networking in particular.

A session is started at one point in time and eventually 'torn down' - that is, brought to an end - at a later moment. In a well-established communication session, more than one message may be sent in either direction.

A connection-oriented communication requires the establishment of a session. In connectionless communication modes, a session is also the first stage in transmitting data.

Session hijacking, often called cookie hijacking, is the act of taking control of an already established trustworthy session in order to steal or compromise the data of the user. In a session hijacking attack, the attacker takes control of the user's valid session, and sends packets to the server while impersonating the real user.

Discussion

What's the role of cookies in session hijacking?
Cookie hijacking, is the exploitation of a valid computer session in computer science. It is specifically applied to the theft of a magic cookie that is used to authenticate a user to a distant service. It's crucial for web developers because the HTTP cookies used to keep a session on many websites can be stolen by an attacker utilising an intermediary computer or accessing the victim's saved cookies.
For example: Justin receives an email advertising a sale at his favourite online retailer, which he clicks on and logs in to begin shopping. After which, a session is created on the server. This maintains the state and is referenced during his any future requests. The session ID generated is stored in cookies, URLs, and hidden fields of websites, based on predictable parameters like the current time or the user's IP address, making them easy to determine for an attacker. The attacker sends an email with his own session ID in the link to Justin. As Justin has saved credit card details for easy use in the future, the attacker after stealing the session uses the card details to go on a shopping spree.
What are the different types of session hijacking?
An example of active session hijacking. Source: Scrivener Publishing.
An active session hijacking occurs when an attacker takes control of the victim's active session and begins to communicate with the server as a legitimate user. A common way to break a user's connection to the server is to flood the target system with a large amount of traffic. The attacker gets complete control over the session after putting the victim into offline mode. Using packet sniffing tools the attacker remains in stealth mode during this process, listening and monitoring the packets transiting the network.
In a passive session hijacking attack, the attacker listens to all of the data and records it for future attacks. In most circumstances, the attacker must start with passive mode to launch any type of hijacking attack. The attacker may not succeed in impersonating a user to the server unless the user session is still active. This is a typical man-in-the-middle attack because the attacker is in-fact between the user and the server modifying and sending the packet.
In hybrid session hijacking, the attacker uses both passive and active attack techniques to successfully execute the attacks.
What are the levels of session hijacking?
Levels of session hijacking. Source: Learn Hub.
Hackers use Network level session hijacking to personalise their assault and breach the protocol's data flow shared by all online applications. TCP (Transmission Control Protocol) allows dependable end-to-end communication over an unreliable network. The attacker prevents the client and the server from exchanging data by forging acceptable packets for both ends that appear like actual packets, taking command of the session. UDP (User Datagram Protocol) is weaker than TCP as it does not employ sequence/numbers. The hijacker fakes a server reply to a client UDP request before the server can react.
The attacker aims to hijack current sessions and establish new sessions with stolen data at the Application level. HTTP (Hyper Text Transfer Protocol) used by the World Wide Web specifies how messages are formatted and delivered between clients and servers, and what actions Web servers and browsers should take response to various instructions. The first step in hijacking HTTP sessions is obtaining Session IDs. The areas to get a session ID are: in the HTTP GET request URL obtained by the browser, by using cookies saved on the client's computer and within the form fields.
What are the methods of session hijacking?
Brute force – The attacker guesses the session ID and uses it to hijack the session, usually when a website's security is low and the session IDs are short and easy to guess.
Cross-site scripting – An attacker finds security flaws in a web server and injects scripts into it, which gives the session ID to the attacker.
Malware – To hijack a session, cybercriminals can deceive one into opening a link that installs malware (malicious software) on the device. It finds a session, steals the session cookie, and delivers it to the attacker.
Session Sidejacking – An attacker obtains access to a user's network traffic, usually when the user connects to an insecure Wi-Fi network, and further monitors the internet user's network traffic using "packet sniffing".
Session fixation - An attacker creates a session ID and deceives the user into using it to establish a session, by sending an email to the user with a link to a login form for a website.
In the man-in-the-middle (MITM) attack, the attacker is placed between the victim and another system and acts as an unknown proxy for one/both of the two communicating destinations.
Which are some session hijacking tools and approaches used by attackers?
CookieCadger is a free open-source tool for detecting "information leakage" in online applications. It can look for unencrypted data, including session cookies, on both wired and insecure Wi-Fi networks. CookieCadger is a graphical Java software that automates sidejacking and replay of HTTP requests in order to detect data leakage from applications that use unencrypted GET requests.
DroidSheep is an open-source Android app that uses "packet sniffing" to extract session cookies and other exposed data from unsecured Wi-Fi web browsing sessions. DroidSheep is a basic Android tool for stealing web sessions (sidejacking).
In May 2012, Google Play released an app called WhatsApp Sniffer. It may show messages from other WhatsApp users who were on the same network as the app user. WhatsApp used an XMPP(Extensible Messaging and Presence Protocol) infrastructure with encryption at the time, rather than plain-text communication.
FireSheep is a Firefox browser add-on. The FireSheep addon allowed attackers to identify and copy unencrypted session cookies that might be exploited in session hijacking attacks via "packet sniffing." FireSheep took advantage of security flaws and is no longer compatible with the FireFox browser.
How can session hijacking attacks be prevented?
The session ID, a piece of data used in network communications to identify a session, is recommended. This lowers the chances of an attacker guessing a valid session ID via trial and error or brute force attacks.
When you use public Wi-Fi, also use a VPN (virtual private network) to assist stay safe and prevent session hijackers out of your sessions is one of the best practices on the client-side. The data sent and received using a VPN is encrypted.
Prevent clicking on any unconfirmed link in an email unless it comes from a legitimate sender to avoid falling victim to a scam, on the client-side.
Install reliable security software on devices to identify viruses and guard against malware, on the client-side including the malware used by attackers to hijack sessions.
Keep an eye on the site's security. Session hijacking is prevented by measures in place at reputable banks, email providers, online retailers, and social media sites. Smart website owners will enable HTTPS (Hypertext Transfer Protocol Secure) across the board, not only on the homepage. They'll also quickly identify and close security flaws. This a server-side prevention technique.
How does an attacker identify vulnerabilities?
These vulnerabilities (weaknesses/defects that can be exploited by an attacker) make session hijacking possible:
Session IDs created using Fragile Algorithm:
A session ID is a data piece used in network communications to identify a session. Websites generally create them using linear algorithms with easily calculable variables like time or IP address. By submitting a large number of requests, an attacker can observe a chronological pattern and generate a legitimate session ID.
Undefined Session-Termination Time:
An attacker has plenty of time to guess a legitimate session ID if the session expiration time is unknown. On obtaining a user's cookie file, the attacker can exploit passive session IDs to get access to the user's web account.
Plain-Text Transmission:
The unencrypted data delivered over the network can readily be sniffed for Session ID. SSL is used to encrypt data during transmission and prevent it from being sniffed.
Small Session IDs:
They can be easily determined by using a strong cryptographic technique. The attacker can even figure out the session ID pattern.
Indefinite attempts:
For websites without an account lockout, the attacker can make multiple attempts with different session IDs until the original session ID is discovered.

Milestones

2007

Warning of webmail wi-fi hijack. Using public Wi-Fi hotspots has become a lot riskier, as security experts have revealed techniques that may capture login data over the air.

2010

Firesheep, a Mozilla Firefox extension, is launched, providing a simple way for session hijackers to attack users of unencrypted public Wi-Fi. Websites such as Facebook, Twitter, and any others that the user adds to their preferences allow the Firesheep user to quickly access private information via cookies, endangering the personal property of public Wi-Fi users.

2011

Facebook is now SSL-encrypted throughout. Not only during log-in, but also on all other pages of the Facebook social networking site, secure data transmissions via SSL are now available. As a result, even cookies are now transferred in encrypted form, and attackers employing tools like Firesheep can no longer read and exploit them for fraudulent purposes.

2011

Twitter adds "Always use HTTPS" option.Twitter implements a new feature that allows users to always use HTTPS when accessing Twitter.com, delivering secure data transmissions via SSL not only during log-in, but also for other pages. This means that even cookies are now transferred in encrypted form, and attackers employing tools like the Firesheep plugin for Firefox can no longer read and exploit them for fraudulent purposes.

2012

A Google Play app called WhatsApp Sniffer is released. It may show messages from other WhatsApp users who are on the same network as the app user. WhatsApp connects using an encrypted XMPP infrastructure rather than plain text.

References

Article Stats

1780

Words

Authors

Edits

Chats

Likes

5208

Hits

Cite As

Devopedia. 2022. "Session Hijacking." Version 9, March 31. Accessed 2024-06-25. https://devopedia.org/session-hijacking

Contributed by
2 authors

Last updated on
2022-03-31 08:16:26

web security websecurity browsers devices

HTTP Cookie
Cross-Site Scripting
Transport Layer Security
Secure Sockets Layer
Network Security
Information Security Principles

Session Hijacking

Discussion

Milestones

References

Further Reading

Article Stats

Author-wise Stats for Article Edits

Cite As

See Also

Login