I found a possibility for session fixation in an application I am researching. It is a session fixation through a session ID cookie. Now I've read up on session fixation and the concept is clear and comes down to getting a victim to use the cookie value you (attacker) provide.
From what I understand you cannot set a cookie value for a different domain than you are from. So you cannot just put on your evil site (evil.com) set cookie: sessID=1234 from targetsite.com. So my question is what are all the different avenues that can be used to deliver the cookie to the victim? I already listed the ones I found, so the question is, is there more? (I want to use this information mostly to create some awareness in management that it is a serious thing session fixation).
The ones that I already know:
- XSS (stored and reflective, but you need a vulnerability in the site itself!)
- Leave computer open with page open and wait for someone to login
- MitM (but then you would be able to do a lot more than just fixate a session!)
- Meta tag injection
- DNS server hacking (which is a bit much I think for something like this, but comes down to getting into the domain of the target through the DNS server. As far as I understand it).