Session fixation

Practice



Session fixation exploits a vulnerability in a web application that allows an attacker to gain access to a legitimate user's account.

During the attack, the attacker gives the victim a link (or exploits an XSS vulnerability) containing a predetermined session identifier. The trick is that when the victim logs in after visiting this link (and the website does not have session protection enabled), the attacker now knows the session identifier and can set his own session identifier to the session identifier he gave the victim in order to gain access to the account.

Severity

High

Exploit Likelihood

Medium

Usage Example

In the following example, the attacker is Bob and the victim is Jane. The vulnerable website is http: // localhost .

  • Bob notices that when he logs into bank.com, it automatically assigns him a session identifier in a GET variable. Hmm..
  • Bob then sends Jane an email telling her that bank.com now offers new features (etc.) and that she can access the site via the following link: http: // localhost /? Sess = 034945882309 .
  • Jane follows the link provided by Bob and is presented with the usual login page. She logs in as usual and goes about her business.
  • Now Bob knows Jane's session identifier and can log into her bank account by manually setting the session identifier he gave her.
created: 2020-07-02
updated: 2026-03-08
267



Was this answer useful?
Choose a quick rating so we can improve the next answer for you.
How satisfied are you?


Comments

To leave a comment

If you have any suggestion, idea, thanks or comment, feel free to write. We really value feedback and are glad to hear your opinion.
To reply

Lectures and tutorial on "information security - Cryptography and Cryptanalysis. Steganography. Information protection"

Terms: information security - Cryptography and Cryptanalysis. Steganography. Information protection