Scribd
Upload
126 views7 pages

Session Hijacking

Session hijacking involves taking over a user's active web session by stealing the session identifier. Web applications use state management to maintain session data through cookies or hidden form fields since HTTP is a stateless protocol. Session hijacking can occur when session identifiers are guessable, not unique, or not mapped to the client connection. To prevent hijacking, session IDs should be random, unique, and tied to the client IP address and browser.

Uploaded by

Mohd Isa Andi M
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
126 views7 pages

Session Hijacking

Session hijacking involves taking over a user's active web session by stealing the session identifier. Web applications use state management to maintain session data through cookies or hidden form fields since HTTP is a stateless protocol. Session hijacking can occur when session identifiers are guessable, not unique, or not mapped to the client connection. To prevent hijacking, session IDs should be random, unique, and tied to the client IP address and browser.

Uploaded by

Mohd Isa Andi M
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 7

Session Hijacking

Tarun Lall

What is Session Hijacking

TCP Connection Takeover Takeover of a Web Application Session

State Management

HTTP is Stateless Web Applications need state


User Logins Shopping Carts

State Management, Contd

Client Side Server Side Golden Rule of Web Application Security

Cookies and Hidden Fields

Reasons for Session Hijacking

No Standards for Maintaining State Session Tracking and State information at Client

How to Prevent Session Hijacking

Session Identifiers Should Be Unique Session Identifiers Should Not be Guessable Session Identifiers Should Be Independent

Session Identifiers Should be Mapped with Client-Side Connections

References

Web hacking Attacks and Defense by Stuart McClure, Saumil Shah, Shreeraj Shah http://www.ftponline.com/javapro/2004_01/m agazine/columns/proshop/default_pf.aspx http://www.iss.net/security_center/advice/Exp loits/TCP/session_hijacking/default.htm http://staff.washington.edu/dittrich/talks/qsmsec/script.html

You might also like