Skip to main content
banner image
venafi logo

What is Session Hijacking?

What is Session Hijacking?

Session hijacking, TCP session hijacking, session sniffing
February 27, 2019 | Guest Blogger: Anastasios Arampatzis

Session hijacking, also known as TCP session hijacking, is a method of taking over a web user session by surreptitiously obtaining the session ID and masquerading as the authorized user. Once the user's session ID has been accessed, the attacker can masquerade as that user and do anything the user is authorized to do on the network.

One of the most valuable byproducts of this type of attack is the ability to gain access to a server without having to authenticate to it. Once the attacker hijacks a session, they no longer have to worry about authenticating to the server as long as the communication session remains active. The attacker enjoys the same server access as the compromised user because the user has already authenticated to the server prior to the attack.   

 

Find out how criminals are using real SSL and TLS certificates from the Dark Web. Read the Study.

 

What is a session?

HTTP is stateless, so application designers had to develop a way to track the state between multiple connections from the same user, instead of requesting the user to authenticate upon each click in a web application. A session is a series of interactions between two communication end points that occurs during the span of a single connection. When a user logs into an application, a session is created on the server in order to maintain the state for other requests originating from the same user.

Applications use sessions to store parameters which are relevant to the user. The session is kept "alive" on the server as long as the user is logged on to the system. The session is destroyed when the user logs-out from the system or after a predefined period of inactivity. When the session is destroyed, the user's data should also be deleted from the allocated memory space.

A session ID is an identification string (usually a long, random, alpha-numeric string) that is transmitted between the client and the server. Session IDs are commonly stored in cookies, URLs and hidden fields of web pages.

Besides the useful functionality of session IDs, there are several security problems associated with them. Many of the popular websites use algorithms based on easily predictable variables, such as time or IP address, in order to generate the Session IDs, causing their session IDs to be predictable. If encryption is not used (typically SSL), Session IDs are transmitted in the clear and are susceptible to eavesdropping.

How does session hijacking work?

The most popular culprits for carrying out a session hijacking are session sniffing, predictable session token ID, man in the browser, client-side and session fixation.

Session sniffing is one of the most basic techniques used with application layer session hijacking. The attacker uses a sniffer, such as Wireshark, or a proxy, such as OWASP Zed, to capture network traffic containing the session ID between a website and a client. Once the attacker captures this value, he can use this valid token to gain unauthorized access.

Many web servers use a custom algorithm or predefined pattern to generate session IDs. The greater the predictability of a session token, the weaker it is and the easier it is to predict. If the attacker can capture several IDs and analyze the pattern, he may be able to predict a valid session ID.

A man-in-the-browser attack is similar to a man-in-the-middle attack, but the attacker must first infect the victim's computer with a Trojan through some form of trickery or deceit. Once the victim is tricked into installing malware onto the system, the malware waits for the victim to visit a targeted site. The man-in-the-browser malware can invisibly modify transaction information and it can also create additional transactions without the user knowing. Because the requests are initiated from the victim's computer, it is very difficult for the web service to detect that the requests are fake.

Whereas session sniffing seeks to grab a session ID as it is transmitted across a network, the client-side attacks target end users. The idea is to extract session IDs stored on the victim's system or to use these tokens for the attackers benefit. Client-side attacks can include cross-site scripting (XSS), cross-site request forgery (CSRF) and malicious JavaScript codes.

Session fixation attacks work by stealing a valid session ID that has yet to be authenticated. Then, the attacker tries to trick the user into authenticating with this ID. Once authenticated, the attacker now has access to the victim's computer. Session fixation explores a limitation in the way the web application manages a session ID. Three common variations exist: session tokens hidden in an URL argument, session tokens hidden in a form field and session tokens hidden in a session cookie.

The session hijack attack is very stealthy. Session hijack attacks are usually waged against busy networks with a high number of active communication sessions. The high network utilization not only provides the attacker with a large number of sessions to exploit, but it can also provide the attacker with a shroud of protection due to the large number of active sessions on the server.

How to prevent session hijacking attacks

It is important to remember that it is possible for an attacker to steal and reuse session identifiers or other sensitive cookie values when they're stored or transmitted insecurely. While providing 100% protection can be difficult, encryption is the main defense. When a user authenticates, SSL and a secure cookie should be mandatory. When authenticated users visit one or more secure pages, they should continue to be forced to use HTTPS.

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) can also be very useful in defending your network from session hijack attacks. While implementing these devices can be difficult, the benefits far outweigh the steep implementation costs. IDS/IPS systems look at the data that enters the network and compares it to an internal database of known attack signatures. If the packet is matched against an entry in the IDS/IPS database, the IDS will generate an alert, and the IPS will block the traffic from entering the database.

 

Learn more about machine identity protection. Explore now.

 

Related posts

Subscribe to our Weekly Blog Updates!

Join thousands of other security professionals

Get top blogs delivered to your inbox every week

See Popular Tags

You might also like

Mozilla, Certinomis, digital certificate, broken chain

Mozilla Distrusts Certinomis Issued Certificates

Certificate Poisoning Threatens GnuPG

Certificate Poisoning Threatens GnuPG

PKI, cyber attack, Public Key Infrastructure, encryption

Machine Identity Experts Needed: How to Become a PKI Admin

About the author

Guest Blogger: Anastasios Arampatzis
Guest Blogger: Anastasios Arampatzis
Read Posts by Author
get-started-overlay close-overlay cross icon
get-started-overlay close-overlay cross icon
Venafi Risk assessment Form Image

Sign up for Venafi Cloud


Venafi Cloud manages and protects certificates



* Please fill in this field Please enter valid email address
* Please fill in this field Password must be
At least 8 characters long
At least one digit
At last one lowercase letter
At least one uppercase letter
At least one special character
(@%+^!#$?:,(){}[]~`-_)
* Please fill in this field
* Please fill in this field
* Please fill in this field
*

End User License Agreement needs to be viewed and accepted



Already have an account? Login Here

×
get-started-overlay close-overlay cross icon

How can we help you?

Thank you!

Venafi will reach out to you within 24 hours. If you need an immediate answer please use our chat to get a live person.

In the meantime, please explore more of our solutions

Explore Solutions

learn more

Email Us a Question

learn more

Chat With Us

learn more
Chat