| 名称 |
Session Hijacking |
|
| 攻击可能性 |
典型严重性 |
| High |
Very High |
|
| 摘要 |
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application. |
| 前置条件 |
An application that leverages sessions to perform authentication. |
| 执行流程 |
| 步骤 |
阶段 |
描述 |
技术手法 |
| 1 |
Explore |
[Discover Existing Session Token] Through varrying means, an adversary will discover and store an existing session token for some other authenticated user session. |
|
| 2 |
Experiment |
[Insert Found Session Token] The attacker attempts to insert a found session token into communication with the targeted application to confirm viability for exploitation. |
|
| 3 |
Exploit |
[Session Token Exploitation] The attacker leverages the captured session token to interact with the targeted application in a malicious fashion, impersonating the victim. |
|
|
| 解决方案 | Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-287 |
Improper Authentication |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-21 |
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1185 |
Browser Session Hijacking |
| 1550.001 |
Use Alternate Authentication Material:Application Access Token |
| 1563 |
Remote Service Session Hijacking |
|
| 分类体系：OWASP Attacks |
|
条目编号
|
条目名称
|
| Link |
Session hijacking attack |
|