Session Hijacking

                      Session Hijacking refers to utilization of valid computer session where an attacker takes over a session between two computers. The attacker takes over a valid session id which is used to get over a system and snoop its data. In TCP session hijacking, an attacker takes over a TCP session between two computers.

Why this is successful?

1. No account lockout for invalid session ids.
2. Insecure handling
3. Small session ids
4. Clear text transmission
5. Indefinite session expiration time

Techniques of Session Hijacking

• Brute force: Attacker attempts with different ids until he succeed.
• Stealing: Attacker use different techniques to steal session ids.
• Calculating: Using non-randomly generated ids, attacker tries to calculate session id.

Session ids can be stolen using different techniques such as:

1. Using HTTP referrer header: Attacker tries to lure a user to click a link to a fake web site
2. Sniffing network traffic
3. Using cross site scripting (Explain in a later post)
4. Sending Trojans over client PCs.

Types of Session Hijacking

Active: Attacker finds an active session and takes over

Passive: Hijacks a session but sits back and watches and records all the traffic.

Countermeasures

1. Use Secure shell to connect using a secure communication channel.
2. Pass the authentication cookies over HTTPS connection
3. Implement the logout functionality to terminate a session by the user.
4. Generate the session ID after a successful login
5. Use string or long random numbers for session key
6. Pass the encrypted data between user and the server
7. User education

To be followed by the web developers:

1. Expire the session as soon as user logs out
2. Reduce the life span of a session or a cookie
3. Create session ids with strings or lengthy random numbers to avoid guessing
4. Encrypt session ids between user and server.
5. Regenerate session id after a successful login