1

What are the precondition for performing session fixation attack using XSS?

i.e., in which parameter should the script be injected so that it sets the cookie in browser.

Know condition: Pre and Post login the session Id remains same.

  • What do you mean in which parameter? – tim Mar 15 '17 at 11:10
  • @tim, I read this useful article and tried to reproduce the same in my application(exploresecurity.com/…). Here in this article injection has been made in a parameter called param in URL. The application took the parameter value(i.e. the injected script) and script got executed. But in my application, I was unable to find out the parameter where it should be inserted. – jey Mar 16 '17 at 12:55
  • So you can't actually perform XSS? That is definitely a precondition. You should first try do to something simpler, that's easier to verify (such as show an alert). If the injected script is not executed, see here for help (if the page is indeed vulnerable; otherwise, it will obviously never work). – tim Mar 16 '17 at 13:05
2

Precondition for Session Fixation via XSS

The precondition is as you mentioned that the session id does not change on login, as otherwise session fixation does not work.

Additionally, the session cookie must either not be httpOnly (as you couldn't overwrite it from JavaScript) or not exist yet (ie the user is not currently logged in).

Alternative Attacks

Why would you want to perform session fixation via XSS? For it to work, the victim must enter their login credentials so that the fixated session id is associated with their account.

You could just as well read out the entered password. Now you have full access to the application (not just temporary access), session restrictions do not apply (bound to IP or useragent for example), and it doesn't matter if the session id is regenerated on login.

0

The second S in XSS stands for script. You write a bit of script. Javascript. And set a cookie, e.g.

document.cookie="ASP.NET_SessionID=0a72619fe826d711";

The cookie name will vary depending on on the site.

The cookie value should be the "fixation" value, e.g. your own session ID for the same web site.

  • The question is where do I inject the script to set the cookie. If it is in URL, in which parameter do I need to inject the script. I found this useful article for session fixation with xss-exploresecurity.com/… . But I was unable to reproduce the same in my test application(where sessionID is same pre and post login) as I dont know which parameter I should inject. – jey Mar 15 '17 at 13:18
  • You need to find the XSS weakness. The answer depends on that. For example, you may have found a vulnerability in StackExchange that allows stored XSS in the comments section, in which case you can just type it in and click "Add Comment," which will pass your script in a form variable named comment. – John Wu Mar 15 '17 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.