4

In which layer of the OSI model does session hijacking occur?

I have performed some research on this, and found that the answer is the transport layer.

But is the transport layer not the place where the routing takes place? And when we use packet sniffers like Wireshark, we dump all the packets to our local machine.

We are finally routing them to our machine and then we are playing with the packets. So as all the layers of the OSI model function independently, I believe the answer of the question should be the network Layer.

Improve this question
7
  • What kind of session hijacking are you talking about? If you're talking about hijacking a TCP/IP connection through some kind of routing attack, this would take place at the session layer. If you're talking about TLS hijacking, this would be the application layer.
    – Herringbone Cat
    Mar 17, 2016 at 3:03
  • @HerringboneCat It was a question, asked in CEHv8 mock test. And the correct answer was transport layer. So, I forwarded it over here to get more clarification regarding this.
    – Panda
    Mar 17, 2016 at 3:30
  • 4
    I'd hate to say it, but my opinion is that question was poorly written.
    – Herringbone Cat
    Mar 17, 2016 at 3:43
  • Can u comment on how is, TLS hijacking on APPLICATION layer ? And how is it session for TCP/IP?
    – Panda
    Mar 17, 2016 at 3:48
  • 1
    Note that the Internet only loosely follows the OSI model.
    – user253751
    Mar 17, 2016 at 6:48

2 Answers 2

Reset to default
6

Session hijacking can potentially take place on several levels of the OSI model (possibly all), as well as outside of the network.

Physical: Tap someones physical connection, and send all packets to the MiTM.

Data Link: ARP poison someones ethernet connection, and send all packets to the MiTM

Network: Manipulate the packet routing, and send all packets to the MiTM.

Transport/Session A secure protocol such as SSL/TLS will protect against compromise of the data, but if an attacker has also broken TLS/SSL, then a break at this level would break the protection from compromises at lower levels.

Presentation I can't think of anything at this level, and it doesn't map well onto TCP/IP and protocols, but that doesn't mean it's not possible.

Application You might debate about this, but I'd argue that CSRF, Code injection, and XSS are all at the Application level.

Outside Any compromise of the machine itself that can grab a session key and transmit it to an attack, be it physical, OS or some other application would be outside of the OSI model.

Improve this answer
5

But is it not like the transport layer is the place where the routing takes place?

No, routing takes place on layer 3 of the OSI model, called the network layer.

We are finally routing them to our machine and then we are playing with the packets.

No, it's not being routed to our machine when sniffing network packets as routing takes place on, again, layer 3 of the OSI model.

In a switched environment without having access to the management interfaces of the switches you can capture network packets while performing ARP cache poisoning.

ARP Cache Poisoning

ARP cache poisoning takes place on layer 2 of the OSI model, called the data link layer. ARP cache poising is a technique where a malicious user floods the network with spoofed frames.

By doing so it tells every or a specific node on the network that, for example, the gateway address is the address is the attacker's machine.

In return the malicious user will sent the data stream to the real gateway while intercepting traffic.

As the question does not clearly states what kind of session hijacking is being talked about I'll "assume" it's about application based session hijacking.

In application based session hijacking a malicious user tries to retrieve a user's legitimate session identifier. This is usually stored in a session cookie.

By stealing an active and valid session cookie, the malicious user can "ride the session" and is able to whatever the legitimate user can do within the system.

There are several ways to do this from an application perspective:

  1. Session Fixation

In a session fixation attack, the malicious user set a predefined session identifier on the user's browser.

This can be achieved by sending the users an email with a link containing this predefined session identifier.

  1. Cross Site Scripting

If a web application does not or does not properly perform input validation and does not properly secure the session cookie with the HTTPOnly attribute, it is possible to steal session cookies.

Injecting a specific payload in the application (reflected or persistent) will sent the session cookie information to the malicious user's cookie stealer.

There are other methods of obtaining session identifiers that are not application related, think of:

  1. Malware
  2. Session Sidejacking (Google it!)

I believe the answer of the question should be Network Layer

From an attacking perspective, I think the proper answer should be the Transport Layer and the layers above it, sometimes called the host layers.

Improve this answer
1
  • +1 for correcting me, so, finally should it be network layer or Transport layer ?
    – Panda
    Mar 17, 2016 at 7:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .