Given the following conditions,
- Session ID does not change upon login
- Session ID travels in form of HTTP cookie
- There is no cross site scripting/redirection vulnerability on the login page
is it still possible to perform a session fixation attack?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
First, please read upon session fixation attacks and make sure you understand how they work. You didn't give us the information that is needed to determine whether standard session fixation attacks will work; all of that information is relevant to other attacks, but not to session fixation.
The fundamental characteristic of a session fixation attack is that the attacker manages to enroll the victim into a session that was previously established by the attacker. After this, the attacker has control of a session that is now being used by the victim as well, which may enable the attacker to do all sorts of bad things.
The primary precondition for a session fixation attack to be possible is the attacker has to be able to force the victim to start using a session ID of the attacker's choice. On some web sites, this is possible if the attacker can get the victim to visit a link like
http://yoursite.com/?SID=1209023, because the web site will automatically assign the victim session ID 1209023 for the victim's future browsing on the site. On other web sites, this is not possible, because the web site doesn't work that way.
So, you haven't given us enough information to know whether session fixation attacks will work, because you haven't given us enough information to determine whether the precondition is met.
That said, the site almost certainly has security problems. It is vulnerable to eavesdropping (Firesheep-like attacks) and likely vulnerable to login CSRF.
one possible scenario
Yes, the HTTP traffic is vulnerable to MITM attacks, either by direct packet modification or simply by routing the connection through an HTTP proxy or redirection via DNS poisoning.