A vulnerability through which an attacker can hijack a user's session by fixing the session ID value of the user. If in an application, session ID value remains same pre and post login, then the application is vulnerable to session fixation.

learn more… | top users | synonyms

4
votes
1answer
979 views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
0
votes
0answers
62 views

Preventing Session Fixation: MAC or Hash?

This blog post describes a method for preventing session fixation attacks (in ASP.Net in particular). The idea is that the session id should be tied to the user's identity in a verifiable way, which ...