Can you give me an example of a session fixation attack?

security session-fixation
Tony picture Tony · Jul 13, 2009 · Viewed 8.2k times · Source

I have read about session fixation and from what I understand it forces a user to use an attacker's session. Is this correct? Can you give me an example of how this could offend the user?

Answer

RichieHindle picture RichieHindle · Jul 13, 2009

I don't usually like to post links to Wikipedia, but here's a link to a very good explanation on Wikipedia...

Here's the meat of it:

  • Alice has an account at the bank http://unsafe/. Unfortunately, Alice is not very security savvy.

  • Mallory is out to get Alice's money from the bank.

  • Alice has a reasonable level of trust in Mallory, and will visit links Mallory sends her.

    1. Mallory has determined that http://unsafe/ accepts any session identifier, accepts session identifiers from query strings and has no security validation. http://unsafe/ is thus not secure.
    2. Mallory sends Alice an e-mail: "Hey, check this out, there is a cool new account summary feature on our bank, http://unsafe/?SID=I_WILL_KNOW_THE_SID". Mallory is trying to fixate the SID to I_WILL_KNOW_THE_SID.
    3. Alice is interested and visits http://unsafe/?SID=I_WILL_KNOW_THE_SID. The usual log-on screen pops up, and Alice logs on.
    4. Mallory visits http://unsafe/?SID=I_WILL_KNOW_THE_SID and now has unlimited access to Alice's account.

Related questions

what is the use of anti-forgery token salt?

In ASP.NET MVC 1.0, there is a new feature for handling cross site request forgery security problem: <%= Html.AntiForgeryToken() %> [ValidateAntiForgeryToken] public ViewResult SubmitUpdate() { // ... etc } I found the token generated in html form keep changing every time a new …

Read More
How can I prevent SQL injection in PHP?

If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's …

Read More
SecurityError: Blocked a frame with origin from accessing a cross-origin frame

I am loading an <iframe> in my HTML page and trying to access the elements within it using Javascript, but when I try to execute my code, I get the following error: SecurityError: Blocked a frame with origin "…

Read More