Lably
Skip to content

Session fixation

Cyberattack allowing one to know another's session identifier

  • 12 min read
  • 3 chapters

Related on Lably

Through Computer network, Web server and Phishing

Lab · Class 12Networking BasicsLab · Class 11NodeMCU & IoTLab · Class 6–12AI & Python Builds (Medha AI)

Attack scenarios

Alice has an account at the bank http://unsafe.example.com/

Mallory intends to target Alice's money from her bank.

Alice has a reasonable level of trust in Mallory, and will visit links Mallory sends her.

A simple attack scenario

Straightforward scenario:

  1. Mallory has determined that http://unsafe.example.com/ accepts any session identifier, accepts session identifiers from query strings and has no security validation. http://unsafe.example.com/ is thus not secure.
  2. Mallory sends Alice an e-mail: "Hey, check this out, there is a cool new account summary feature on our bank, http://unsafe.example.com/?SID=I_WILL_KNOW_THE_SID". Mallory is trying to fixate the SID to I_WILL_KNOW_THE_SID.
  3. Alice is interested and visits http://unsafe.example.com/?SID=I_WILL_KNOW_THE_SID. The usual log-on screen pops up, and Alice logs on.
  4. Mallory visits http://unsafe.example.com/?SID=I_WILL_KNOW_THE_SID and now has unlimited access to Alice's account.

Attack using server generated SID

A misconception is that if a server only accepts server-generated session identifiers, it is safe from fixation. This is false.

Scenario:

  1. Mallory visits http://vulnerable.example.com/ and checks which SID is returned. For example, the server may respond: Set-Cookie: SID=0D6441FEA4496C2.
  2. Mallory is now able to send Alice an e-mail: "Check out this new cool feature on our bank, http://vulnerable.example.com/?SID=0D6441FEA4496C2."
  3. Alice logs on, with fixated session identifier SID=0D6441FEA4496C2.
  4. Mallory visits http://vulnerable.example.com/?SID=0D6441FEA4496C2 and now has unlimited access to Alice's account.

This type of attack is similar to a cross-site cookie attack except that it does not rely on the vulnerability of the user's browser. Rather, it relies on the fact that wildcard cookies can be set by a subdomain and that those cookies may affect other subdomains.

Scenario:

  1. A web site www.example.com hands out subdomains to untrusted third parties
  2. One such party, Mallory, who now controls evil.example.com, lures Alice to his site
  3. A visit to evil.example.com sets a session cookie with the domain .example.com on Alice's browser
  4. When Alice visits www.example.com this cookie will be sent with the request and Alice will have the session specified by Mallory's cookie.
  5. If Alice now logs on, Mallory can use her account.

When this attack is complete, Mallory can gain access to www.example.com as Alice.

It is not essential that a user login to exploit session fixation attacks and, although these unauthenticated attacks are not constrained to cross-sub-domain cookie attacks, the implications of sub-domain attacks are relevant to these unauthenticated scenarios. For example, Mallory may provide a URL from their evil site, fixating a session into an unauthenticated scenario, and use those techniques to exploit their target. This includes scenarios exploiting both the unauthenticated scenarios (e.g. forms or registration) as well as the ability to feed the user an established session to bypass the login completely.

Consider, for example, that Mallory may create a user A1ice on www.example.com and login that user to capture a current, valid session identifier. Mallory then entraps Alice with a URL from evil.example.com which fixates that session cookie in Alice's browser (as described above) and redirects to www.example.com for finalizing a particular transaction (or, in fact, broader use). Mallory is thus able to ghost the session from their original login, scraping data and executing operations as 'A1ice' on 'www.example.com'. If Alice was successfully duped and saved her credit card to the account, Mallory might then make purchases using that card.

Sign in to keep reading

2 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970X (social network)American social networking serviceWayback MachineDigital archive by the Internet ArchivePython (programming language)General-purpose programming languageMacOSOperating system for Apple computersUnicodeCharacter encoding standard