Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [session-fixation]

A vulnerability through which an attacker can hijack a user's session by fixing the session ID value of the user. If in an application, session ID value remains same pre and post login, then the application is vulnerable to session fixation.

0
votes
0answers
4 views

Session Management to avoid session fixation [migrated]

How do I maintain the same session state with different session ID as we get a login request? Do I need to do anything else from the server end other than just assigning the session id in Response....
1
vote
1answer
23 views

restoring logged out gmail session in running instance of chromium browser?

My situation is: +I have created a special purpose gmail account +I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone ...
1
vote
0answers
31 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
0
votes
0answers
15 views

Generate new session on auth: before or after 2FA?

I'm following the owasp cheat sheet to handle sessions in my web app: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet It is recommended to always generate a new session on any ...
0
votes
1answer
40 views

Is there a way to know that a cookie is “HTTP Only” on the first user request?

As I was reading the session fixation article on OWASP, I was thinking that the only way for my server to refuse a cookie set by a rogue script would be for my server to know that the browser sent a ...
0
votes
0answers
113 views

Session Fixation in ASP.NET

I am testing ASP.NET application, where session id (ASP.NET_SessionId) is not renewed after login. Actually it is renewed when I use browser, on the login page server sends: Set-Cookie: ASP....
5
votes
1answer
129 views

How to prevent MITM session fixation attack over plain HTTP upon first request?

Websites has various methods implemented to tell browser to always use HTTPS - HSTS header, server redirec to HTTPS, CSP policy. However, the first time a user visits the site it can be over palin ...
3
votes
1answer
130 views

I was logged in as another user to a site, how?

It happened last year but I still wonder to this day. I was looking for coupons for the site Alltrails. I had a free account and wanted to get a Pro account. I randomly opened lots of search results, ...
0
votes
0answers
49 views

Finding the date and time of a session closed in metasploit

I would like to know the time and date of an session when it dies. We can however know the session opened time and date.
3
votes
1answer
132 views

Clarification on how session fixation attacks works

Starting with OWASP I am learning how session fixation attacks work. This is the scenario: The attacker has the session ID generated by the server (by logging in for example), and sends a hyperlink ...
39
votes
2answers
6k views

Can advertisements read cookies of the website it is on?

I know many ads can store third-party cookies, but what about reading cookies? If so, what stops them from reading the session id to perform session hijacking?
6
votes
1answer
3k views

Changing session id after login

My web application is only accessible for authenticated users. Before login the user can only see the main page with a button to log in. The application assign a session ID on the main page, the ...
0
votes
4answers
507 views

Session fixation attack, cookie based sessions over https

A third party security consultant did a Penetration test few of our webapps. One of the findings was a potential session fixation vulnerability. We have several webapps all Java with single sign on ...
1
vote
2answers
2k views

Placing IP address in JSON web token or session cookie

I'm relatively new to security and I'm looking to prevent brute force logins on a web application I'm creating. After doing some research, I decided to go with requiring a captcha after a user ...
4
votes
1answer
191 views

Session renewal how often is necessary?

I am looking at the session management again of a site and currently it renews the client session id on every page refresh. The idea being that if it is stolen directly from the browser there is less ...
3
votes
2answers
479 views

Session Fixation cookie delivery

I found a possibility for session fixation in an application I am researching. It is a session fixation through a session ID cookie. Now I've read up on session fixation and the concept is clear and ...
0
votes
1answer
330 views

Is Session Fixation a tough one to resolve?

Just found session fixation vulnerability in couple of tech giants. Giving the steps I have done: 1. Login to your account in a browser (Browser 1). 2. Extract cookie using cookie extractor. 3. ...
1
vote
2answers
233 views

Session Fixation using XSS

What are the precondition for performing session fixation attack using XSS? i.e., in which parameter should the script be injected so that it sets the cookie in browser. Know condition: Pre and ...
0
votes
2answers
732 views

Testing Session Fixation when cookie is unchanged

I was testing a web application where cookies (session ID, session values) are the same for all times. Even after successful authentication takes place it remains unchanged. The session ID travels in ...
0
votes
1answer
365 views

session hashes,need help to know how it works?

there's a website i visit and i can't understand fully the login process and session hash it creates and uses to keep track of logins and such. would someone help me understand what goes on in server ...
4
votes
3answers
350 views

Checking Browser Agent String for application security

I have recently come across some logs in my application where I have seen the user's browser agent info being switched. Even if the user is using the same browser, the agent info has been modified for ...
1
vote
1answer
180 views

Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)

I was reading this question about Session ID Hijacking and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session ...
0
votes
2answers
1k views

Session Management: Set new value of session ID after privilege change and other sensitive operations

This OWASP Article on session management recommends to set a new value of session ID when: Common scenarios must also be considered, such as password changes, permission changes or switching from ...
26
votes
6answers
10k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
2
votes
2answers
891 views

Comparing Session Hijacking, Fixation and Riding

How do I differentiate between these Session Hijacking/Session Fixation/Session Riding. I find it difficult to understand when read about all three at the same time. I get very confusion between when ...
1
vote
1answer
552 views

insecure HTTP session issue

A java based application supports two user roles. Admin and nonAdmin. Login as Admin ,browser gets JSESSION ID. Login as nonAdmin user from another machine. Browser gets another JSESSION ID. Now ...
2
votes
2answers
70 views

HTTP session fixation

According to wikipedia, Mallory the attacker gets her own SID and then forces Alice to visit a site with the SID. Why wouldn't Mallory just take Alice's SID, if she could MITM Mallory? Also, is this ...
1
vote
1answer
846 views

How to protect the Session ID?

I have been doing some reading over the past few days on Session IDs and the methods taken to prevent people from intercepting them and using them to hijack a session. From what I have read, when ...
4
votes
1answer
1k views

Session Identification Hashing - How to make it more Secure and Robust

I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class In that post a user by name @AnotherGuy has raised ...
1
vote
2answers
2k views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
0
votes
1answer
320 views

Is SESSION is safe for transferring encrypted email and password in PHP

I am working on a project where I am using PHP_SESSION, Somewhere I heard that PHP_SESSION are quite unsafe for passing valuable data so I have to know what are the security flaws, how it can be ...
1
vote
1answer
639 views

Session Fixation - Is that even an issue here?

Someone stepped up to me calling me out on not assigning a new session-ID on successfull login. Basically i was told: The fact that i use the same cookie (with the same SID) in the login-page as well ...
2
votes
2answers
7k views

Exploiting a potential ASP.NET web app Session Fixation vulnerability

I am pen-testing an ASP.NET application that is exhibiting Session Fixation behavior. The application is using cookie based sessions. Basically: When you land on the page no Session cookie is created ...
0
votes
1answer
133 views

Preventing Session Fixation: MAC or Hash?

This blog post describes a method for preventing session fixation attacks (in ASP.Net in particular). The idea is that the session id should be tied to the user's identity in a verifiable way, which ...
6
votes
3answers
3k views

prevent session hijacking in PHP

I wrote the log In/log Out scripts of my web page and when the user logs in I store in the $_SESSION variable the user agent. Now each time a page is loaded I check if the user is logged in or not and ...
5
votes
1answer
2k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
-5
votes
5answers
1k views

What is the difference between session fixation and session recreation?

I have read that both of them are conventionally the same. But there must be a few differences which differentiates the two terms. Anyone please explain.
2
votes
2answers
1k views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
1
vote
3answers
157 views

Session Fixation - Setting path to root without /

I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains. My url currently looks like this: http://s1....
3
votes
2answers
1k views

Am I understanding correctly how to stop a certain OAuth2 session fixation attack?

Please find here described an OAuth2 session fixation attack. Is the attack possible? And am I understanding correctly how it can be stopped? The attack Mallory starts logging in at client.example....
7
votes
2answers
5k views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
-2
votes
2answers
1k views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
10
votes
1answer
4k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2.7 ...
2
votes
2answers
1k views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
2
votes
1answer
6k views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
1
vote
1answer
1k views

Preventive Measure for detecting Session Fixation attacks

From my understanding if i am not wrong in session fixation attacks. The attacker login into the server as a legitimate user and creates a valid session. He then the tricks the compromised user to use ...
14
votes
2answers
9k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
21
votes
5answers
8k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
8
votes
2answers
16k views

Best way to securely set a session cookie on another domain

We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com. The www site does not have an SSL certificate and is on a different domain. We have a login button on http://www.foo.co.uk ...
9
votes
4answers
17k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...