Re: Session Hijacking over HTTP

Hey 11ack3r,

On Tue, 18 Mar 2008, 11ack3r wrote:

Hello Everyone,

I was curious to know how would webmail portals like gmail.com and yahoo.com protect their users from session hijacking when they use HTTP after authentication.

Nice question;)

As I see it is trivial to capture traffic over the wire including session cookies. In such a case can an attacker just reuse the session cookies in his/her browser and compromise the user account?

You should try xenion's recently released cookietools:

http://xenion.antifork.org/cookietools/
http://www.securityfocus.com/archive/101/484866/30/570/threaded

Unfortunately, antifork.org seems down at the moment. However, there's a mirror here:

http://packetstormsecurity.org/web/cookietools-0.3.tgz

WHat is the best way to protect session cookies from hijacking esp.
due to network eavesdropping? Of course HTTPS can also be bypassed
with MITM attacks if users ignore browser warnings.

http://en.wikipedia.org/wiki/Session_hijacking
http://www.owasp.org/index.php/Category:Session_Management

Cheers,

--
Marco Ivaldi, OPST
Red Team Coordinator Data Security Division
@ Mediaservice.net Srl http://mediaservice.net/


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: Global.asa not firing
    ... Make sure session cookies are enabled in your browser - Tools, ... Make sure you haven't disabled session state in Internet Services Manager, ... Open the Internet Services Manager MMC tool, ...
    (microsoft.public.inetserver.asp.general)
  • Re: Session Hijacking over HTTP
    ... How to protect yourself. ... The fact that each HTTP connection is a different IP session makes using ... To protect session cookies you can set the cookie property: ...
    (Pen-Test)
  • Re: Life without session variables
    ... > I've always used session cookies in my web sites. ... > Design Strategies for Scalable Active Server Applications by Steve Kirk ... > ASP Design Tips, ASP Web Database Demo, Free ASP Bar Chart Tool... ...
    (microsoft.public.inetserver.asp.general)
  • Re: RAM based cookies
    ... > We do not want to store our session data in SQL Server or a State Server ... >> Why would performance issues prohibit the use of Session Cookies? ... >>> because we have clustered web servers and do not want to store session ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Life without session variables
    ... I've always used session cookies in my web sites. ... I believe that session variables can still be used even if a user has ... ASP Design Tips, ASP Web Database Demo, Free ASP Bar Chart Tool... ...
    (microsoft.public.inetserver.asp.general)