2

As I understand, the basic concept of Session Hijacking is intercepting a packet in which the victim sends its cookie/session credentials to a server, be it Facebook/Twitter/YouTube/Whatever.

But wherever I look and whatever I read, a MITM (Man In The Middle) attack is required. And I do not understand why. Packets are broadcast to the entire network. I can see (or at least should see) those packets with Wireshark regardless. Given that if I enter with my laptop in a coffee shop, I should see all traffic on that network, why do I have to perform a MITM attack?

Improve this question
1
  • Can you supply a source of such a claim?
    – schroeder ♦
    Jan 23, 2016 at 0:45

4 Answers 4

Reset to default
1

Session Hijacking can also hijack a session that has already been established. And you're right, all you need is the packet, and not to be in the middle of the flow. For instance, if the session management is improperly configured, you could reestablish the same session if the user disconnects from the server.

Perhaps what you are reading is making a differentiation between "session hijacking" and "sidejacking".

Perhaps the most famous case of session hijacking is Firesheep. Their slides explain how it does what it does, and it does not require to be in the middle.

Improve this answer
2
  • Am I right in thinking Firesheep is one of the things that kicked off the widespread conversion to HTTPS over the last few years?
    – user253751
    Jan 23, 2016 at 8:56
  • @immibis absolutely
    – schroeder ♦
    Jan 23, 2016 at 20:45
1

I'm assuming that you are talking about session in the context of a web application, i.e. not the TCP session or TLS session but an authorized session of a web application. This one is usually maintained by a cookie and often all what you need to hijack the session is to have access to this session cookie.

Access to this session cookie can be done with a man in the middle attack by reading the cookie from the intercepted transferred packets. It can be done by passively reading the packets where no man in the middle access is needed but only passive access to the packet. This access is possible for instance at the mirror port of a router. But even without access at the network layer session hijacking might be possible, because the cookie might be readable from JavaScript by exploiting an cross-site-scripting (XSS) bug in the web application.

And there might be more kind of attacks possible, depending on how good the protections against session hijacking are. See also OWASP for more ideas.

Improve this answer
0

To answer your question, you do not need a man in the middle attack if you are already able to observe their traffic. However, a MitM attack may be required on a switched network, for example, because the victim's traffic will not otherwise travel to your computer. With an open (or encrypted with a known key) wireless network, you don't usually need to to MitM since you can passively sniff those packets, same goes for a hub network or a tap/mirror port.

Improve this answer
0

First of all Session Hijacking does not require MiTM and can be achieved also by other attack vectors such as cookie stealing through XSS or other web attacks such as Session Fixation.

Also Packet Sniffing with tools like Wireshark will not work on Switched Network and to be able to to MiTM you will need to perform other attacks such as ARP spoofing.

https://www.owasp.org/index.php/Session_hijacking_attack https://www.owasp.org/index.php/Session_fixation
https://www.owasp.org/index.php/Man-in-the-middle_attack

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .