Practice
Session fixation exploits a vulnerability in a web application that allows an attacker to gain access to a legitimate user's account.
During the attack, the attacker gives the victim a link (or exploits an XSS vulnerability) containing a predetermined session identifier. The trick is that when the victim logs in after visiting this link (and the website does not have session protection enabled), the attacker now knows the session identifier and can set his own session identifier to the session identifier he gave the victim in order to gain access to the account.
High
Medium
In the following example, the attacker is Bob and the victim is Jane. The vulnerable website is http: // localhost .
Comments