Everything about Session hijacking
Exploitation of a valid computer session
In computer science, session hijacking, sometimes also known as cookie hijacking, is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many websites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer. After successfully stealing appropriate session cookies an adversary might use the Pass the Cookie technique to perform session hijacking. Cookie hijacking is commonly used against client authentication on the internet. Modern web browsers use cookie protection mechanisms to protect the web from being attacked. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Session hijackingA 5-minute orientation
- Skim a recent paper: The development of countermeasures against session hijackingInfluential work since 2022
- Pick up a classic book: International airport security and anti-hijacking measuresThe most-reprinted book on the subject
- Read the landmark paper: Unveiling Vulnerabilities of Web Attacks Considering Man in the Middle Attack and Session HijackingCited 43 times
- Go sideways: Secure cookieA closely related topic
- Go sideways: HTTP cookieA closely related topic
📖 Definitions
Noun A type of exploit where a victim’s session ID is stolen, allowing the attacker to access a service the victim is logged in to.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
Unveiling Vulnerabilities of Web Attacks Considering Man in the Middle Attack and Session Hijacking
Session Hijacking and Prevention Technique
CookiExt: Patching the browser against session hijacking attacks
A Session Hijacking Attack Against a Device-Assisted Physical-Layer Key Agreement
Survey of the Protection Mechanisms to the SSL-based Session Hijacking Attacks
A survey on registration hijacking attack consequences and protection for session initiation protocol (SIP)
Assessment of Secure OpenID-Based DAAA Protocol for Avoiding Session Hijacking in Web Applications
An Analytical Study of Web Application Session Management Mechanisms and HTTP Session Hijacking Attacks
🆕 Influential since 2022
The development of countermeasures against session hijacking
ADOPTION OF SECURE SESSION MANAGEMENT IN MULTI-DEVICE APPLICATIONS FOR MITIGATING SESSION HIJACKING AND REPLAY ATTACKS THROUGH TOKEN ROTATION AND EXPIRY CONTROLS
Preventing And Mitigating Session Hijacking Using Zero Trust Architecture
Session hijacking vulnerabilities and prevention algorithms
Evolusi Serangan Session Hijacking dan Inovasi Teknik Pencegahannya
📚 Books worth reading
- 📕International airport security and anti-hijacking measuresUnited States. Congress. Senate. Committee on Commerce, Science, and Transportation. Subcommittee on Aviation. · 1985
International terrorismUnited States. Congress. House. Committee on International Relations. · 1978- 📕International terrorism, 1985United States. Congress. House. Committee on Foreign Affairs · 1985
- 📕Anti-hijacking act of 1973United States. Congress. House. Committee on Interstate and Foreign Commerce. Subcommittee on Transportation and Aeronautics. · 1973
Computer security and penetration testingAlfred Basta · 2008- 📕Confronting piracy off the coast of SomaliaUnited States. Congress. Senate. Committee on Foreign Relations · 2009
- 📕International terrorismUnited States. Congress. House. Committee on Public Works and Transportation. Subcommittee on Aviation. · 1978
- 📕Ongoing efforts to combat piracy on the high seasUnited States. Congress. Senate. Committee on Armed Services. · 2009
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Secure cookie Secure cookie is a type of an HTTP cookie that has the Secure attribute set, which limits the scope of the cookie to "secure" channels (where "secure"…
- HTTP cookie An HTTP cookie (also called web cookie, Internet cookie, browser cookie, or simply cookie) is a small block of data created by a web server while a user…
- Internet security Internet security is a branch of computer security focused on the Internet. It includes browser security, web application security, and network security…
- Password Authentication Protocol Password Authentication Protocol (PAP) is a password-based authentication protocol used by Point-to-Point Protocol (PPP) to validate users. PAP is specified…
- Challenge-Handshake Authentication Protocol In computing, the Challenge-Handshake Authentication Protocol (CHAP) is an authentication protocol originally used by Point-to-Point Protocol (PPP) to…
- Cross-site request forgery Cross-site request forgery (CSRF, sometimes pronounced sea-surf) is a type of malicious exploit of a website or web application where unauthorized commands…
- Firesheep Firesheep was an extension for the Firefox web browser to hijack sessions. It used a packet sniffer to intercept unencrypted session cookies from websites…
- Man-in-the-middle attack In information security, a man-in-the-middle (MITM) attack, or on-path attack, is a scenario where an attacker secretly relays and possibly alters the…