Kochure is a module i developed as part of my final year project based on "Mitigating HTTP Session Hijacking", This article is a discussion of the module we came up with, the implementation of this model in the form of an apache module, and the testing and results of this module. Whe
This is a tutorial that demonstrates just how simple it is to get access to facebook accounts without the user's password or username. This tutorial demonstrates Session Hijacking (discussed here: http://www.cleverlogic.net/tutorials/session-hijacking-0). This is a simple attack done on an unsecured wifi network with the permission of all users on the network.
The aims of this tutorial are:
Firesheep is a Firefox extension that demonstrates HTTP session hijacking attacks over unsecured wireless networks. Firesheep is a simple module, and has no spectacular functionality other than a simple and easy to use user interface that allows end users to carry out session hijacking attacks. This module was implemented in 2010 with the aim of educating users about the insecurities of plain HTTP connections and unsecured wireless networks (GmbH, 2011).
Stealing session information using proxy servers involve tricking the user’s browser into connecting to a server different from the one she thinks she is connecting to. An email message might, for example, offer a special 50% discount (for carefully selected users only, of course) on anything at Amazon.com, with a convenient link to that site—except, of course, that link is actually to the attacker’s own server, something like this:
“<a href="http://reallybadguys.com/gotcha.php">Click here for a 50% discount at Amazon.com!</a>”
All of the other methods of session hijacking (http://cleverlogic.net/content/session-hijacking) focus on stealing or predicting a session identifier already created, and using it. Session fixation, on the other hand is where the attacker sets the user’s session identifier before that user logs into a site. In this case, the attacker would know the user’s Session identifier and can easily make use of this identifier (ACROS, 2007). Session identifiers can be fixed by the use of:
Session sidejacking is a Session Hijacking(http://cleverlogic.net/content/overview-session-hijacking) attack where the hacker steals the client’s session cookie; the cookie is usually stolen by an attacker sniffing packets transferred between a server and a client, and stealing the session cookie from these packets. This attack can be carried out by: (1) an attacker on the same local area network (LAN) as the client, and (2) an attacker that has access to data transferred between that client and the server.
Since packets are mostly stolen from users connected to unsecured networks (especially wireless networks), this attack can be prevented by avoiding the use of unsecured networks.
As the name suggests, the session prediction is a Session Hijacking attack that focuses on predicting session identifiers. Some web applications use non-random numbers as session identifiers, therefore, if an attacker is able to understand how session identifiers are generated by that server, the attacker can predict a valid session identifier and gain access to that application. This method is mostly used when an attacker just wants to gain access to an application and not access to any specific user’s account; since it will be extremely difficult to predict a session identifier for a specific user; this is due to the fact that session identifiers are usually generated using several variables including time.
Session Hijacking is an attack by which a hacker exploits a valid computer session and gains access to a client’s session identifier. Since HTTP is a stateless protocol, when a user logs into a website, a session is created on that Web Server for that user, this session contains all this user's information being used by the server so the username and password is not needed at every page request. The server uses a unique identifier(Session Identifier) to authenticate this user to this session, this session identifier is passed between the web server and the user's computer at every request.
