In this article we will be talking about session hijacking and exploitation. You will learn about session management with its applications and the common ways of hacking session tokens. You will also learn how the key methods of session hijacking helps the hacker to penetrate the session. Get to know the differences that are present between session hijacking, session fixation and session spoofing, and also the activities that attackers will perform after the successful session hijacking. Finally, learn how we can prevent the session hijacking.
Introduction to session management
Session management is a rule interface that helps interaction of the user with the web applications. HTTP is the communication protocol that websites and browsers use to interact and share the data. A session is a continuous HTTP request. Transactions are created that belong to the same user.
HTTP is a stateless protocol. The response pair and request are completely Predictable Session Tokens of the similar web interface and interactions. Current command is not dependent on the previous command. This makes us bring in the concept of session management which primarily interfaces the authentication and access control. These are both enabled in web applications.
There are primarily the following types of session management:
They can be used as silos or can be used together. The best use case is to track the number of unique visitors to the website.
Introduction to session hijacking and cookies
Session hijacking refers to an attack on a user session by a hacker. The session is live when we log into any service. The best use case is when we log in to our web application, say banking application, to do some financial transaction. The other name for the session hijacking is Cookie Hijacking or cookie side jacking. The more accurate information that a hacker gets regarding our sessions, the more precise is the hacker’s attack. This session hijacking is common for browser sessions and web applications.
Session Hijacking Workflow
Common ways of hacking session tokens
A session Token can be compromised by the following ways:
Predictable Session Token
- Session ID should be unpredictable in the browser or the web application.
- Session token should be extremely descriptive for the hacker to not recognize it easily.
- Should not be with short session keys.
Session Sniffing
- Attacker uses a valid sniffer to capture the valid session ID.
- The hacker gets unauthorized access to the web server.
Client Side attacks – ( XSS, Malicious JavaScript Codes, Trojans)
- Hacker hijacks the session ID by using the malicious code or programs running at the client side.
- Cross Site Scripting attack is very common to steal the session token.
- Can be done with malicious JavaScript codes.
Man in the Middle attack
- The hacker intercepts the communication between two systems.
- Hacker can split the original TCP connection into two new connections, Client and hacker and another hacker and server.
- Hacker acts like a proxy server and will be able to read, modify or edit the data.
Man in the Browser Attack
- Very similar to the Man in the Middle Attack.
- Trojan Horse is used to intercept.
- Manipulation done between the browser and application.
Key methods of session hijacking
There are five key methods of Session hijacking:
- Session Fixation
- Session Side Jacking
- Cross Site Scripting
- Malware
- Brute Force
Session Fixation
- The hacker or attacker already has information about the session ID of the user.
- The hacker would have sent the email containing the Session ID.
- Attacker has to wait for the user to login.
- The hacker sends the user a crafted login that contains the hidden field with the fixed session ID.
Session Side Jacking
- Hacker uses the packet sniffing technique to find the network traffic between two parties.
- Hacker then steals the session cookie.
- Most possible attacks happen in Unsecured Wi-Fi Spots.
- Even if the websites use SSL, the hacker can easily attack the networks to access the servers and get access to information or session of the users.
- Hacker uses Man in Middle Attack as one of the classic use cases for this session side jacking.
Cross Site Scripting
- Attacker sends the user a running code to get a copy of the cookie.
- For the user, these seem trustworthy as it is the server information.
- Typically, the hacker uses client-side script, such as JavaScript.
- This code attacks the browser to execute arbitrary code and provides information on session hijacking.
- Types – Reflected XSS, Stored XSS, DOM- Based XSS
Malware
- Unwanted programs to steal the browser cookie files
- Performed without a user knowledge to obtain file or memory contents of the user’s computer or the server
- Hacker creates a client browser temporary local storage called as Cookie Jar.
Brute Force
- Hacker uses key generation algorithms to get the session ID.
- Algorithm recognizes the sequential keys.
- Maximizes the predictable sessions and accesses the user's active session.
- Entropy is compromised using Brute Force and hacker is successful in stealing the information.
- Can only be protected with short predictable session identifier.
- We can use longer session keys.
Exploiting the session hijack vulnerability
Four categories of Vulnerabilities exploit the session hijack:
XSS Vulnerabilities
- Injecting Client-Side Scripts
- JavaScript is embedded
- Creates a faulty page and hacker attacks
Session Side Jacking Vulnerabilities
- Use packet Sniffers to attack
- E.g.- Man in the middle attack
Session Fixation Vulnerabilities
- Mainly done through fake websites
- User assumes it is an original link and clicks
Malware Installation Vulnerabilities
- The hacker sends the malicious code to disrupt the application or networks or the communication
- Hacker gets access to the applications
Overall, the hacker exploits session hijacking through various vulnerabilities making the system highly unstable and gains unauthorized access. The user is not aware of any of the system changes, and he assumes that the session is original. The hacker gains control of the data or information through these vulnerabilities.
Difference between session hijacking, session fixation and session spoofing
Topic | Session Hijacking | Session Fixation | Session Spoofing |
|---|
| Goal | To get unauthorized access to active user session | To get unauthorized access to active user session | To steal or modify the data |
| Method | Through Sniffing network traffic | This is an inverted technique to get access through pre-defined session cookie planted in the user browser | Can be done through fake Email, fake Website or fake IP address creations |
| Activity | Performed on user who is currently logged in and already authenticated | The hacker already knows the session IDs for getting unauthorized access | Attackers use stolen or counterfeit session tokens to initiate a new session and impersonate the original user, who might not be aware of the attack |
What Can Attackers Do After Successful Session Hijacking?
- The attacker can perform any action that the user was carrying out with his credentials.
- The hacker can gain access to multiple web applications, from financial systems and customer records to line-of-business systems potentially containing valuable intellectual property.
- The attacker can use session hijacking cookies for identifying authenticated users in single sign-on systems (SSO).
- Here are a few examples:
- Attackers can log into bank accounts for transferring money
- Hackers can use the access for online shopping
- Hackers can get access to sensitive data and sell it on the dark web
- Hackers can demand a ransom from the user in exchange for the data
Prevention of Session hijacking
- Session hijacking can be protected by taking preventive measures on the client side.
- Software Updating, End Point Security will be a key from a user side.
- Having Biometric authentication for every user session can prevent attacks.
- End to End encryption can be done between the user browser and web server using secure HTTP or SSL.
- We can have the session value stored in the session cookie.
- We can have an automatic log off after the session ends.
- We can use session ID monitors.
- VPN use can prevent unauthorized access.
- Web server generating long random session cookies can prevent attacks.
- Usage of Session ID monitors enhances security.
- Deleting the session cookie from the user server and computer enhances security.
- Having different HTTP header order for different sessions is a good precaution.
Conclusion
In this article we have covered the key concepts of session hijacking and the ways by which this activity can be performed by the hacker. We have discussed the methods for unauthorized access by hackers or attackers, including the techniques used by hackers for injecting vulnerabilities. We have understood the concept of Session spoofing and Session fixation. We learnt the various activities that a hacker can perform after getting control of the user session, and finally touched upon how to prevent session hijacking.
