Re: IIS6 - Can session id be manipulated?

Kim wrote on Tue, 29 Jan 2008 12:59:41 +0100:

Hi,

I have gotten a question about how IIS6 handles the session id
(cookie).
I've got a very persistent customer who claims, that you can just
hijack another session by changing the session id in your own session
cookie.
I'm no security expert, but I find that very hard to believe. All
though I haven't been able to find documentation about how the IIS
handles the session id in a secure way, so it can't be manipulated.

Does anyone have some links to MS descriptions or something like that,
so I can show the customer you can just hijack another persons
session?

Thanks,
John

I'm pretty sure that your customer is right - otherwise you'd get all sorts
of issues with customers on dynamically changing IP addresses or proxies
hiding other possibly identifiable information to tie the cookie to. Of
course, the hijacker would have to actually guess or determine the session
cookie that they want to hijack, and if they manage to intercept the cookie
then hijacking a session could be the least of your, or your customers,
problems as they'd likely also be able to just dump all the packets and view
what is being passed back and forth anyway.

I don't use the ASP sessions except for the odd occassion where it makes it
easy to handle some non-critical temporary data (like generated captcha
values for subsequent comparison in forms), all the sites I run use a custom
session handling system that combines a variety of factors to determine
possible hijacking of the cookies used.

--
Dan


.

Relevant Pages

  • Re: IIS6 - Can session id be manipulated?
    ... I've got a very persistent customer who claims, ... hijack another session by changing the session id in your own session ... to get the session cookie the hijacker would have to intercept the data when ...
    (microsoft.public.inetserver.iis.security)
  • Re: [PHP] Session Authentication
    ... This system authenticates the user via ... > mysql, when the user is authenticated, i set a session variable to let the ... cracker could hijack your session id and the system would think that ... authentication in a cookie on the client. ...
    (php.general)
  • Re: session wont timeout
    ... Maybe this is a session cookie issue? ... client browser there is this one: WSS_KeepSessionAuthenticated Expires: At ... If I kill the session cookie using IE Developer Toolbar, ... possible and IIS would throw another challenge. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Is it safe to store user_id in Session?
    ... What I was wondering is how safe it is to store user_id or username or ... session so I do not need to search the database all the time. ... OVERRIDING BASIC SESSION COOKIE AUTHENTICATION ... So what is described in the article only works for bad php scripts. ...
    (comp.lang.php)
  • Chicken and egg issue with Cookie based login?
    ... I have few questions I hope someone can clear up for me with the cookie ... private web server. ... It also says this about the secret key: ... Second, would be an example of the "Session ID" or more general, what is an ...
    (comp.security.misc)