Is there a way to modify the value of a session token with HttpOnly flag set in this scenario?

Question

SCENARIO:

When a user browses to the login page the web application sets SESSIONID=X; Httponly; before the authentication.

After the authentication NO new cookies are set. The only cookie used to identify the session is SESSIONID=X.

This should mean that the webapp is vulnerable to the session fixation attack. I want to develop a complete attack so I need a way to programmatically modify the value of SESSIONID.

The server doesn't use security headers (X-XSS-Protection, etc.), so the login page can be inserted into an iframe and XSS are not blocked.

Is there a way to change the value of SESSIONID when the victim access the login page through attacker web server?

Answer 1

Is there a way to change the value of SESSIONID when the victim access the login page through attacker web server?

Nope. When the victim visits attacker's web server and loads the iframe, victim's browser directly establishes new connection (such as HTTP request) to the website inside the iframe, not by going through attacker's website first then the real website.

Answer 2

The usual way to attack something like this would be to find a public or at least shared computer (e.g. in a school computer lab or your own/somebody else's computer that you're permitting somebody/permitted to use briefly), visit the login page, open the dev tools, and record the generated token for later. Then when the victim actually logs into the site (on that computer), you'll know their session token already, and can hijack their session from another computer where you inject the recorded cookie.

Single-user machines, or those that you can't yourself access, are generally not exploitable via this type of session fixation threat.