Session Hijacking

This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.

Abstraction

Standard

Typical severity

Very High

Likelihood of attack

High

Understand the attack

What is this attack pattern?

Execution flow

How does the attack proceed, step by step?

Explore

Discover Existing Session Token

Through varrying means, an adversary will discover and store an existing session token for some other authenticated user session.

Experiment

Insert Found Session Token

The attacker attempts to insert a found session token into communication with the targeted application to confirm viability for exploitation.

Exploit

Session Token Exploitation

The attacker leverages the captured session token to interact with the targeted application in a malicious fashion, impersonating the victim.

Requirements

What does the attack require?

Prerequisites

An application that leverages sessions to perform authentication.

Skills required

Low: Exploiting a poorly protected identity token is a well understood attack with many helpful resources available.

Resources required

The adversary must have the ability to communicate with the application over the network.

Impact

What does a successful attack lead to?

Gain Privileges

Affected scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and mitigated?

Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated.