O'Reilly logo

Web Penetration Testing with Kali Linux - Third Edition by Juned Ahmed Ansari, Gilberto Najera-Gutierrez

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Session Fixation

Sometimes, the user-provided information is used to generate the session ID, or worse, the user-provided information becomes the session ID. When this happens, an attacker can force a user to use a predefined identifier and then monitor the application for when this user starts a session. This is called Session Fixation.

WebGoat has a somewhat simplistic, yet very illustrative demonstration of this vulnerability (go to WebGoat | Session Management Flaws | Session Fixation). We will use it to illustrate how this attack can be executed.

  1. The first step sets you up as the attacker. You need to craft an email to include a session ID (SID) value in the link that you are sending to the victim, so add that parameter with any value, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required