IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [session-fixation]

A vulnerability through which an attacker can hijack a user's session by fixing the session ID value of the user. If in an application, session ID value remains same pre and post login, then the application is vulnerable to session fixation.

68 questions
1
vote
1 answer

Is my session schema vulnerable to session fixation?

I have a PHP application, where two session IDs are being used. I will use foo and bar as example for those session IDs. The foo session ID is being generated at the login page. The bar session ID is being generated after a successful login. The…
Chetan Soni
  • 11
  • 1
1
vote
1 answer

restoring logged out gmail session in running instance of chromium browser?

My situation is: +I have created a special purpose gmail account +I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone number +I unintentionally logged out before…
kinda.autistic
  • 13
  • 2
1
vote
0 answers

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon sessions and wiped them from memory. The only…
Cygnini - ShadowRi5ing
  • 11
  • 3
1
vote
2 answers

Session management: Are the features of application server enough?

HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go back and forth between web pages of the same…
M.S. Dousti
  • 1,514
  • 17
  • 23
1
vote
2 answers

Session Fixation using XSS

What are the precondition for performing session fixation attack using XSS? i.e., in which parameter should the script be injected so that it sets the cookie in browser. Know condition: Pre and Post login the session Id remains same.
Jaka
  • 152
  • 1
  • 1
  • 8
1
vote
1 answer

Session hashes - how it works?

There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such. Would someone help me understand what goes on in server and what happens to session IDs and login info?…
forbes.nash
  • 11
  • 4
1
vote
1 answer

Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)

I was reading this question about Session ID Hijacking and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session IDs over re-logging in with a UN/PW combo, or…
XaolingBao
  • 897
  • 2
  • 9
  • 21
1
vote
1 answer

insecure HTTP session issue

A java based application supports two user roles. Admin and nonAdmin. Login as Admin ,browser gets JSESSION ID. Login as nonAdmin user from another machine. Browser gets another JSESSION ID. Now edit this JSESSIONID and replace with Admin's…
renu
  • 21
  • 3
0
votes
1 answer

Is SESSION is safe for transferring encrypted email and password in PHP

I am working on a project where I am using PHP_SESSION, Somewhere I heard that PHP_SESSION are quite unsafe for passing valuable data so I have to know what are the security flaws, how it can be hacked and how to protect yourself from them, Every…
Abhinav Shrivastava
  • 1
0
votes
1 answer

Preventing Session Fixation: MAC or Hash?

This blog post describes a method for preventing session fixation attacks (in ASP.Net in particular). The idea is that the session id should be tied to the user's identity in a verifiable way, which means that a given session id can't be valid for…
bmm6o
  • 151
  • 2
0
votes
1 answer

A few questions about fixation attack

I am writing a small app. It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp. Attacker uses the app In this App, once they log out the sessionID is destroyed. If they are still logged in,…
Mah Neh
  • 25
  • 5
0
votes
0 answers

Session Fixation PoC

I wonder what Session Fixation exploit possibilities still exist today in case the website does not change the Session-ID in a cookie after login other than the following: XSS MiTM open redirect vuln We've encountered a customer website which has…
VJSpeter
  • 1
  • 1
0
votes
0 answers

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the security of their system. how can i make explain…
pashani jaulani
  • 1
  • 1
0
votes
1 answer

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests are bypassed because the Cookie header is now…
Supraja
  • 7
  • 5
0
votes
1 answer

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I logged into the website by providing the correct…
Supraja
  • 7
  • 5
1 2 3
4
5