Session Hijacking.

What is session hijacking?

OWASP says session hijacking exploits the web session control mechanism. That mechanism is normally protected by a session token. A web server sends this token to the browser after the user logs in, and the browser sends it back so the server can tell which user is making each request. If an attacker compromises the token, OWASP says they can use a valid session token to gain unauthorized access to the web server.

How does session hijacking work?

OWASP lists several ways a token can be compromised:

• Predictable session token generation.
• Session sniffing, which means intercepting network traffic.
• Client-side attacks such as cross-site scripting or malicious code in the browser.
• Man-in-the-middle or man-in-the-browser attacks.

MITRE covers the theft side under stealing web session cookies. It says an adversary may steal a web application or service session cookie and use it to gain access as an authenticated user without needing credentials. MITRE adds that cookies can be taken from disk, browser memory or network traffic.

Why does it matter?

A stolen session token can let an attacker skip the login step. MITRE says the attacker does not need the user’s credentials. Reasoning from this, a strong password alone may not protect an account once its session is taken. MITRE also says session cookies can be used to bypass some multi-factor authentication protocols, so MFA alone may not stop this.

How can you detect and reduce it?

MITRE lists these mitigations for cookie theft:

• Use hardware-based tokens that include the login domain, and limit logins to trusted enrolled devices.
• Delete cookies regularly and keep how long they stay valid short.
• Teach users to spot phishing domains and to avoid running untrusted JavaScript.
• Restrict or block web content that could be used to extract session cookies, and keep browsers and related software updated.

For detection, MITRE points to suspicious access to browser cookie storage and unusual reads of browser process memory. It also advises monitoring logins for stolen cookie use, such as unusual travel patterns or anomalous behavior.

Is session hijacking the same as account takeover?

Not exactly. Session hijacking is one method, and it works through the session token. Account takeover is the wider outcome, where an attacker controls someone else’s account by any route, such as a password.

Is session hijacking the same as session fixation?

This page does not cover session fixation, which is a separate attack on session management. The sources used here describe stealing or abusing an existing token.

One route to a stolen session is interception in a man in the middle attack.

Related terms

See also session cookies, adversary-in-the-middle and account takeover.

Sources

• OWASP: OWASP defines session hijacking and lists ways a session token can be compromised.
• MITRE ATT&CK: MITRE describes stealing web session cookies to act as an authenticated user, with mitigations and detection ideas.