I'm writing a new website with php and I will be using cookies to track user session data. Before I finalise the design I want to make sure that the site is not vulnerable to attacks. I have written a list of attack methods and come up with counter measures for each one. Can anyone think of any more attack methods and if so also propose suitable counter measures?
a list of all attack methods I could think of:
- guess/bruteforce session cookie
- steal session cookie (eg if the attacker saves the session cookie to usb)
- cross site scripting
- phishing (session fixation)
- sql injection
- http header injection
It should be noted that I will be using my own database to store session info - not the php standard session functions. When I detect an attack I will run a function called
warn_and_halt() which will log the attack and inform the sysadmin, then halt the session under attack.
My counter measures for each of the above attack types are:
- rather than using a large integer for the session id stored in the cookie, i will generate my own random number then hash it with something like sha1 to make it a little harder to guess. of course the session id may not be unique if created this way so i will have to check all of the other session ids in the database and regenerate if the newly generated session id already exists. im confident with this measure.
- im assuming the usb will be taken to another computer and the session cookie loaded into another browser. i will be logging the user agent (browser name) for each session. if the user agent changes during the session then i will
warn_and_halt(). i have read of people using the ip address to validate the session id, however i don't think i will be using this at all since ip addresses can change during a session for completely innocent reasons - for example if the user's router resets and negotiates a new ip with their isp. can anyone suggest more counter measures here?
- i will set the session cookie as httponly and also check the domain of incoming cookies. there is not much which can be done to prevent what happens on a browser in my view - the browser may choose not to comply with the httponly flag - nothing i can do there! does anyone know of a better way to prevent xss?
- i envisage phishing to happen by user BAD logging in to my site, then emailing a link such as
- sql injection is a problem with much larger scope than stealing session ids, but i will be countering it in general by always escaping the incoming data (including from cookies) and by filtering out any wrong characters with regex. i think i have this one pretty well covered.
- i only just learned about http header injection. nevertheless it seems pretty easy to counter - just escape the incoming header fields - especially for carriage returns and validate incoming headers.
so those are all of the attacks and counter measures i could think of (after a fair bit of reading online...). if you see any that i have missed, please respond. and if you see that any of my counter measures are insufficient, please do tell :)