Sometimes, the user-provided information is used to generate the session ID, or worse, the user-provided information becomes the session ID. When this happens, an attacker can force a user to use a predefined identifier and then monitor the application for when this user starts a session. This is called Session Fixation.
WebGoat has a somewhat simplistic, yet very illustrative demonstration of this vulnerability (go to WebGoat | Session Management Flaws | Session Fixation). We will use it to illustrate how this attack can be executed.
- The first step sets you up as the attacker. You need to craft an email to include a session ID (SID) value in the link that you are sending to the victim, so add that parameter with any value, ...
