A vulnerability through which an attacker can hijack a user's session by fixing the session ID value of the user. If in an application, session ID value remains same pre and post login, then the application is vulnerable to session fixation.
Questions tagged [session-fixation]
68 questions
1
vote
1 answer
Is my session schema vulnerable to session fixation?
I have a PHP application, where two session IDs are being used.
I will use foo and bar as example for those session IDs.
The foo session ID is being generated at the login page.
The bar session ID is being generated after a successful login.
The…
![](../../users/profiles/207616.webp)
Chetan Soni
- 11
- 1
1
vote
1 answer
restoring logged out gmail session in running instance of chromium browser?
My situation is:
+I have created a special purpose gmail account
+I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone number
+I unintentionally logged out before…
![](../../users/profiles/189753.webp)
kinda.autistic
- 13
- 2
1
vote
0 answers
Rotating session names vs a static session name with a rotating validation string
I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon sessions and wiped them from memory. The only…
1
vote
2 answers
Session management: Are the features of application server enough?
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go back and forth between web pages of the same…
![](../../users/profiles/7.webp)
M.S. Dousti
- 1,514
- 17
- 23
1
vote
2 answers
Session Fixation using XSS
What are the precondition for performing session fixation attack using XSS?
i.e., in which parameter should the script be injected so that it sets the cookie in browser.
Know condition: Pre and Post login the session Id remains same.
![](../../users/profiles/141997.webp)
Jaka
- 152
- 1
- 1
- 8
1
vote
1 answer
Session hashes - how it works?
There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such.
Would someone help me understand what goes on in server and what happens to session IDs and login info?…
![](../../users/profiles/134972.webp)
forbes.nash
- 11
- 4
1
vote
1 answer
Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)
I was reading this question about Session ID Hijacking
and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session IDs over re-logging in with a UN/PW combo, or…
![](../../users/profiles/106817.webp)
XaolingBao
- 897
- 2
- 9
- 21
1
vote
1 answer
insecure HTTP session issue
A java based application supports two user roles. Admin and nonAdmin.
Login as Admin ,browser gets JSESSION ID.
Login as nonAdmin user from another machine. Browser gets another JSESSION ID.
Now edit this JSESSIONID and replace with Admin's…
![](../../users/profiles/125448.webp)
renu
- 21
- 3
0
votes
1 answer
Is SESSION is safe for transferring encrypted email and password in PHP
I am working on a project where I am using PHP_SESSION, Somewhere I heard that PHP_SESSION are quite unsafe for passing valuable data so I have to know what are the security flaws, how it can be hacked and how to protect yourself from them, Every…
0
votes
1 answer
Preventing Session Fixation: MAC or Hash?
This blog post describes a method for preventing session fixation attacks (in ASP.Net in particular). The idea is that the session id should be tied to the user's identity in a verifiable way, which means that a given session id can't be valid for…
![](../../users/profiles/67647.webp)
bmm6o
- 151
- 2
0
votes
1 answer
A few questions about fixation attack
I am writing a small app.
It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp.
Attacker uses the app
In this App, once they log out the sessionID is destroyed. If they are still logged in,…
![](../../users/profiles/277145.webp)
Mah Neh
- 25
- 5
0
votes
0 answers
Session Fixation PoC
I wonder what Session Fixation exploit possibilities still exist today in case the website does not change the Session-ID in a cookie after login other than the following:
XSS
MiTM
open redirect vuln
We've encountered a customer website which has…
![](../../users/profiles/246501.webp)
VJSpeter
- 1
- 1
0
votes
0 answers
Cookie-based sessions
During an engagement, i have been asked by a client to explain (with the use of one
or more examples) whether having an authenticated cookie-session web upload
functionality can be dangerous for the security of their system. how can i make explain…
![](../../users/profiles/277168.webp)
pashani jaulani
- 1
- 1
0
votes
1 answer
Passing the session ID of an unauthenticated user to a valid session using Burp
I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension).
So ideally, the Autorize says the requests are bypassed because the Cookie header is now…
![](../../users/profiles/276725.webp)
Supraja
- 7
- 5
0
votes
1 answer
Session ID not changed after logging in/ logging out
I am testing website security when I came across this:
When I enter the site URL, the user is given a session ID without any user input like:
7F746326038B30F51609423B2086BEBB
Scenario 1: Once I logged into the website by providing the correct…
![](../../users/profiles/276725.webp)
Supraja
- 7
- 5