Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/1121791136719261700
added 57 characters in body; edited tags; edited title
Source Link
Anders
Anders
  • 65.8k
  • 25
  • 185
  • 226

Plausible scenario / vivid example for thea PHP session fixation (defaultattack with default settings)?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for thea session fixation attack against a PHP application running with default settings.

Given session.use_only_cookies's default value is On, an attacker cannot just use a GET request. What are other options? Javascript will require both session.cookie_httponly to be Off and also a working XSS. The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?

I am not arguing against the use of session_regenerate_id() but an impressive example demonstrating why it's an absolute necessity always helps.

Plausible scenario / vivid example for the PHP session fixation (default settings)?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for the session fixation.

Given session.use_only_cookies's default value is On, an attacker cannot just use a GET request. What are other options? Javascript will require both session.cookie_httponly to be Off and also a working XSS. The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?

I am not arguing against the use of session_regenerate_id() but an impressive example demonstrating why it's an absolute necessity always helps.

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings.

Given session.use_only_cookies's default value is On, an attacker cannot just use a GET request. What are other options? Javascript will require both session.cookie_httponly to be Off and also a working XSS. The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?

I am not arguing against the use of session_regenerate_id() but an impressive example demonstrating why it's an absolute necessity always helps.

Source Link
Your Common Sense
Your Common Sense
  • 746
  • 3
  • 13

Plausible scenario / vivid example for the PHP session fixation (default settings)?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for the session fixation.

Given session.use_only_cookies's default value is On, an attacker cannot just use a GET request. What are other options? Javascript will require both session.cookie_httponly to be Off and also a working XSS. The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?

I am not arguing against the use of session_regenerate_id() but an impressive example demonstrating why it's an absolute necessity always helps.