According to wikipedia, Mallory the attacker gets her own SID and then forces Alice to visit a site with the SID. Why wouldn't Mallory just take Alice's SID, if she could MITM Mallory? Also, is this attack without MITM only susceptible to SID in query string?
Mallory doesn't want Alice's session id. Mallory wants Alice to perform actions as herself, but while the website thinks she's Mallory. Like use her credit card to buy something she thinks she'll get, but which will actually be credited to Mallory.
There are several vectors for this attack. The one you mention, cookie-less sessions with the session id in the URL is one. Mallory having control of a sub-domain and being able to write cookies for a parent domain is another.
Within the scope of the article, the point is that there are 2 different methods by which Mallory gains control over Alice's session. Where the methods differ is when you consider the larger world in which such an attack may occur.
- if Mallory can get Alices to click on a link and the target system allows session ids to be set from a URL, then Mallory can fixate the session id.
Here no MITM is required.
- a session id supplied to the client over a secure channel cannot be MITMed without breaking the secure channel. There are extensions to tbe http protocol that allow a cookie to be flagged to only be returned over HTTPS connections. But cookies set via HTTP are returned over both HTTP and HTTPS. Hence if Mallory can interfere with Alices HTTP communications, she can fixate the session value which will subsequently be used over a secure channel.
Here there is only a MITM of the unsecured channel.
Here the mitigation of using HTTPS, even if enforced with HSTS is inneffective.
Only the cookie name and its value are sent back to the server, not the options it was created with, its path, host, scheme or expiry time, nor anything else about the provenance of the data.
There are also scenarios where hijacking is a more effective attack than fixation.