Skip to main content
60 votes
Accepted

Can advertisements read cookies of the website it is on?

Any script included into a page can read all cookies for which the httpOnly attribute is not set. Access restrictions for scripts are not determined based on the domain the script was loaded from but ...
Steffen Ullrich's user avatar
57 votes
Accepted

Can't a user change his session information to impersonate others?

Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked. There have been cases where best practice ...
Topher Brink's user avatar
  • 1,639
27 votes

Can't a user change his session information to impersonate others?

Yes. It can. Session information is stored in server side (except the session token) while cookies in the other way are stored in the client side (browser). So the attacker might change the session ...
Vini7's user avatar
  • 659
21 votes

Can advertisements read cookies of the website it is on?

Each cookie belongs to a domain (an origin). Every modern browser implements a same-origin policy which prevents a script from accessing cookies of an origin that's different from the one running the ...
Arminius's user avatar
  • 44.9k
20 votes

Can't a user change his session information to impersonate others?

There seems to be some confusion between cookeis and session information here, so lets start by sorting that out: Cookies are stored on the client. The user can therefore change them if they want to. ...
Anders's user avatar
  • 65.7k
10 votes
Accepted

Changing session id after login

The reason why it is best to change session ID's upon login is due to potential man-in-the-middle vulnerabilities. If an attacker captures your session ID, they can use it to pose as the legitimate ...
Henry F's user avatar
  • 636
9 votes

Protecting against cross-subdomain cookie attacks

Public Suffix has a list of domains that all vendors (Chrome/Firefox/IE/Safari/Opera) use to avoid this problem of stealing cookies from other subdomains (along side other features). The list is ...
Sairam's user avatar
  • 723
6 votes

How to protect the Session ID?

Is SSL/TSL and HttpOnly enough to be sure that a session cannot be hijacked? Those are the must dos, and they offer good (but not perfect) protection. See question four. Is there a way to use ...
Anders's user avatar
  • 65.7k
5 votes

Can't a user change his session information to impersonate others?

Session IDs need to be cryptographically safe in the sense that you cannot simply guess them. Usually, it is just a random looking 128-bit number and it has absolutely no obvious connection to the ...
kaidentity's user avatar
  • 2,654
5 votes
Accepted

Can a URL contain executable JavaScript?

Is there ANY way, an URL can run embedded JavaScript? A URL cannot run anything. A URL is just a string. How an URL can be used or abused depends on the context and application where it is used. ...
Steffen Ullrich's user avatar
4 votes
Accepted

Testing Session Fixation when cookie is unchanged

For there to be a session fixation vulnerability, the server most somehow save some input that you (the attacker) can control as a value for the session ID. OWASP has a handy list: Session token in ...
Anders's user avatar
  • 65.7k
4 votes
Accepted

Comparing Session Hijacking, Fixation and Riding

In session hijacking the attacker somehow gets hold of the victims session ID and uses it to impersonate the victim. The attacker essentially takes over the victims session - hence the name. To do ...
Anders's user avatar
  • 65.7k
4 votes
Accepted

Placing IP address in JSON web token or session cookie

I see a few things to think about: You'd need to make very sure that a login attempt is only valid when the client sends you a valid session cookie. Otherwise, the attacker can just not send a ...
Out of Band's user avatar
  • 9,283
4 votes
Accepted

Clarification on how session fixation attacks works

When the attacker uses an already existing session ID, doesn't the server know that the session id has already been taken by the attacker? The attacker would send a link with a session ID that is ...
Anders's user avatar
  • 65.7k
3 votes

Session renewal how often is necessary?

You are right that it doesn't really provide more security. Except usability problems and increased complexity, I'm not sure what it brings. For example, if you change the session_id and invalidate ...
Gudradain's user avatar
  • 7,021
3 votes

Comparing Session Hijacking, Fixation and Riding

Session Hijacking: It is a "general term" used for exploitation of the web session control mechanism, which is normally managed for a session token. Now a session can be hijacked in different ways -- ...
Rahil Arora's user avatar
  • 4,377
3 votes

Checking Browser Agent String for application security

Don't use the user agent for security purposes. It's not reliable and easy to change. As others noted, every browser can set the user agent to an arbitrary value. It's just an information header that ...
Arminius's user avatar
  • 44.9k
3 votes
Accepted

HTTP session fixation

Mallory doesn't want Alice's session id. Mallory wants Alice to perform actions as herself, but while the website thinks she's Mallory. Like use her credit card to buy something she thinks she'll ...
Xander's user avatar
  • 35.8k
3 votes
Accepted

Session Fixation: A token and an id

No, you are not vulnerable to session fixation, because of this authToken that you give to your clients when they log in. You would be if ...the attacker has fixed a session he knows on the victim's ...
AccountantM's user avatar
3 votes
Accepted

Hardening ASP.NET against session fixation: Should I change the session ID despite the additional Auth cookie?

I think you could ignore the report. Tools automate tasks so you should always review the findings, as in this case. The tool maybe just checks if the value of the cookieA is equals to the value of ...
Maicake's user avatar
  • 567
3 votes
Accepted

Do I still need a CSRF token?

Depends how confident you are in the "no subdomains" and "no browsers too old to understand SameSite cookie flag" conditions. Both of those have several ways to break them. The &...
CBHacking's user avatar
  • 49.5k
2 votes

HTTP session fixation

Within the scope of the article, the point is that there are 2 different methods by which Mallory gains control over Alice's session. Where the methods differ is when you consider the larger world in ...
symcbean's user avatar
  • 18.7k
2 votes
Accepted

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

On modern browsers, you can (and probably should) use the __Host- prefix in you cookie name. On moderns browsers, these cookies can only be set from a secure origin and cannot use the Domain attribute ...
ysdx's user avatar
  • 1,775
2 votes

Session hashes - how it works?

A session is data stored on the server corresponding to some client. To know which data to access, the client gets a cookie with a session identifier. The value of this identifier is not meaningful, ...
Sjoerd's user avatar
  • 31.8k
2 votes

Session Fixation using XSS

Precondition for Session Fixation via XSS The precondition is as you mentioned that the session id does not change on login, as otherwise session fixation does not work. Additionally, the session ...
tim's user avatar
  • 29.7k
2 votes

Session Management: Set new value of session ID after privilege change and other sensitive operations

It is important to quote the previous sentences too: The session ID must be renewed or regenerated by the web application after any privilege level change within the associated user session. The ...
grochmal's user avatar
  • 5,887
2 votes

Session Fixation cookie delivery

In addition to your list: Uncontrolled subdomain Your site runs on example.com although the attacker controls bob-usercontent.example.com. This could either be through poor design or a server admin ...
SilverlightFox's user avatar
2 votes

How to prevent MITM session fixation attack over plain HTTP upon first request?

Assuming that you always redirect the user from HTTP to HTTPS, you can put your session identifier in a secure HTTP-Only cookie which the server never sends via HTTP. Actually, in my case the HTTP to ...
Alexis Wilke's user avatar
  • 1,017
2 votes

Session Fixation: A token and an id

We can't tell for sure with the information provided. In order to verify, you could try to access some protected resource (which is only available after login), with different Requests: Request with ...
Euphrasius von der Hummelwiese's user avatar
2 votes
Accepted

How often should I reset my users' session cookies?

Session fixation is an attack where the victim using a vulnerability fixes a session id in the victims browser and then when the user authenticates himself the application does not provide a new ...
yeah_well's user avatar
  • 3,804

Only top scored, non community-wiki answers of a minimum length are eligible