Hackers Beware

Types of Session Hijacking

With hijacking, there are two basic types of attacks: active and passive. With a passive attack, an attacker hijacks a session, but just sits back and watches and records all of the traffic that is being sent back and forth. This is useful for finding out sensitive information, like passwords and source code.

In an active attack, an attacker finds an active session and takes over. This is done by forcing one of the parties offline, where the user can no longer communicate, which is usually done with a Denial of Service attack. (For additional information on Denial of Service attacks, please see Chapter 6, “Denial of Service Attacks.”) At that point, the attacker acts like that user, takes over the session, and executes ...