Live briefing
Everything about Session fixation
Cyberattack allowing one to know another's session identifier
In computer network security, session fixation attacks attempt to exploit the vulnerability of a system that allows one person to fixate another person's session identifier. Most session fixation attacks are web based, and most rely on session identifiers being accepted from URLs or POST data. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Session fixationA 5-minute orientation
- Skim a recent paper: Single-session EUS-directed Transgastric ERCP with a Dedicated Over-the-scope Fixation Device: A Feasibility StudyInfluential work since 2022
- Pick up a classic book: The web application hacker's handbookThe most-reprinted book on the subject
- Read the landmark paper: Mobile Session Fixation Attack in Micropayment SystemsCited 10 times
- Go sideways: Cross-site request forgeryA closely related topic
- Go sideways: HTTP cookieA closely related topic
📖 Definitions
Noun An exploit where the attacker sets or finds out the victim's session identifier.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
Mobile Session Fixation Attack in Micropayment Systems
Helix tack for lumen-apposing metal stent fixation in single-session EUS-directed transgastric ERCP
Through-the-scope proximal flange fixation: “Edging” toward single-session procedures for all?
Outcomes of Single-Session EDGE with Clip Fixation: A large U.S. Experience
Assessing Eye Movement Dynamics and Fixation Stability Between Eyes During Same-Session Bilateral LASIK
Fixation or exploration? A state-dependent dual decoder approach to attribute-aware session-based recommendations
🆕 Influential since 2022
📚 Books worth reading
The web application hacker's handbookDafydd Stuttard, Marcus Pinto · 2007- 📕Mécanismes de fixation du salaire minimum et problèmes connexesInternational Labour Conference (53rd : 1969 : Geneva, Switzerland) · 1969
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Cross-site request forgery Cross-site request forgery (CSRF, sometimes pronounced sea-surf) is a type of malicious exploit of a website or web application where unauthorized commands…
- HTTP cookie An HTTP cookie (also called web cookie, Internet cookie, browser cookie, or simply cookie) is a small block of data created by a web server while a user…
- Session hijacking In computer science, session hijacking, sometimes also known as cookie hijacking, is the exploitation of a valid computer session—sometimes also called…
- Session (computer networking) In computer science and networking, a session is a two-way link, a relatively high layer in the OSI stack enabling interactive information exchange between…
- Same-origin policy In computing, the same-origin policy (SOP) is a concept in the web application security model. Under the policy, a web browser permits scripts contained…
- Cross-site scripting Cross-site scripting (XSS) is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side…
- Session poisoning Session poisoning (also referred to as "session data pollution" and "session modification") is a method to exploit insufficient input validation within…
- Secure cookie Secure cookie is a type of an HTTP cookie that has the Secure attribute set, which limits the scope of the cookie to "secure" channels (where "secure"…