📘 SESSION HIJACKING NOTES
SECTION 1: SESSION HIJACKING CONCEPTS
1️⃣ What is Session Hijacking?
• A session is a temporary connection between a client and a server after authentication.
• Session Hijacking: Attacker takes control of a valid user session without knowing the password.
Example: Stealing a bank session cookie to access the account.
2️⃣ Why is Session Hijacking Successful?
• Weak or predictable session IDs
• Session IDs transmitted in plaintext (HTTP)
• No session timeout
• Most countermeasures fail without encryption
• Most computers using TCP/IP are vulnerable
3️⃣ Session Hijacking Process
Steps: 1. Place yourself between victim & server (sniff traffic)
2. Monitor packet flow & predict sequence numbers
3. Desynchronize victim’s session
4. Take over session using session ID
5. Inject commands to the server
Result: Attacker stays connected without detection; can steal data, inject backdoors, etc.
4️⃣ Packet Analysis of Local Session Hijack
• Capture session packets (using Wireshark)
• Track connection → desynchronize → inject commands
• Attacker can see data, perform actions as victim
5️⃣ Types of Session Hijacking
Type Description
Passive Only observes traffic, records info (passwords, session IDs)
Active Takes over the session, e.g., MITM attack
6️⃣ Session Hijacking in OSI Model
• Network-Level (Layer 3-4): TCP/UDP packets, IP addresses
• Application-Level (Layer 7): Session IDs, cookies, tokens
1
7️⃣ Spoofing vs Hijacking
• Spoofing: Pretends to be someone; starts new session with stolen credentials
• Hijacking: Takes over an already active session
SECTION 2: APPLICATION-LEVEL SESSION
HIJACKING
1️⃣ Compromising Session IDs Using Sniffing
• Attacker uses sniffer to capture session ID from network traffic
• Works if site is HTTP, not HTTPS
• Example: Using Wireshark to steal cookies
2️⃣ Compromising Session IDs by Predicting Tokens
• Predict session IDs generated by weak algorithms
• Examples:
• Sequential: JBEX1001, JBEX1002
• Timestamp: JBEX20240611T1234
3️⃣ Brute Force & Weak Random Number Generators
• Small token space → attacker tries all possible tokens
• Predictable PRNG → attacker can guess session ID
• Lack of rate limiting makes brute force easier
4️⃣ MITM (Manipulator-in-the-Middle) Attack
• Attacker intercepts client-server communication
• Can read, modify, inject data
• Split TCP connection: client → attacker → server
5️⃣ MITB (Manipulator-in-the-Browser) Attack
14-Step Flow: 1. Trojan infects OS/browser
2. Trojan installs malicious extension
3. Browser loads extension on restart
4. Extension registers handler for targeted URLs
5. Monitors user actions
6. User logs in normally
7. Extension registers button click events
8. Extracts/modifies form data
9. Modified form sent to server
10. Server processes as normal
11. Server generates receipt
12. Browser shows receipt (appears normal)
2
13. User believes transaction is normal
14. Attacker gains session info
6️⃣ Client-Side Attacks
• XSS: Malicious JavaScript steals cookies
• CSRF: Attacker tricks browser into sending session automatically
CSRF Example:
1. User logged into bank
2. Attacker puts malicious link on another site
3. User clicks → browser sends cookie automatically → attacker performs transaction
7️⃣ Session Replay Attack
• Attacker captures authentication token
• Replays it later to gain access
8️⃣ Session Fixation
• Attacker creates session ID → sends to victim
• Victim logs in using same ID
• Attacker now has valid session ID to access account
9️⃣ Proxy-Based Hijacking
• Attacker sets up fake server
• Victim connects → attacker forwards request to real server
• Attacker captures session data
🔟 CRIME Attack
• Exploits HTTPS compression
• Steals session cookies by analyzing compressed size
• Step Example: Attacker injects CRIME JavaScript → victim’s HTTPS compressed traffic leaks cookie
1️⃣1️⃣ FORBIDDEN Attack
• Exploits reuse of TLS nonces
• Hijacks HTTPS session → injects malicious content
• Victim discloses sensitive info (passwords, cards)
1️⃣2️⃣ Session Donation Attack
• Attacker logs in → gets valid SID
• Sends SID link to victim
• Victim enters info → attacker accesses it
• Difference from session fixation: victim initiates action, but attacker’s session is used
3
SECTION 3: NETWORK-LEVEL SESSION
HIJACKING
Targets Layer 3 (Network) and Layer 4 (Transport).
TCP 3-Way Handshake
1. SYN → request connection
2. SYN-ACK → server acknowledges
3. ACK → client confirms
Connection established
1️⃣ TCP/IP Hijacking
• Attacker predicts next TCP sequence number
• Sends spoofed packet
• Takes over active session
• Example: Interrupt conversation, inject message before victim replies
2️⃣ IP Spoofing (Source Routed Packets)
• Fake IP address in packet
• Server believes packet from trusted host
• Attacker injects malicious packets
3️⃣ RST Hijacking
• Send forged RST packet to reset connection
• Requires correct ACK number
• Connection terminated for victim
4️⃣ Blind Hijacking
• Inject malicious data into TCP session
• Attacker cannot see response
• Example: Shouting answer in class without knowing teacher’s reply
5️⃣ UDP Hijacking
• Attacker sends fake UDP reply before real server
• Victim accepts fake reply
• Example: Asking teacher question → someone shouts wrong answer before teacher replies
6️⃣ MITM Using ICMP & ARP
• ARP spoofing → map fake MAC addresses
• ICMP redirect → fake routing info
• Traffic routed through attacker
4
7️⃣ PetitPotam Attack
• Forces Windows Domain Controller to authenticate to attacker
• Captures NTLM authentication
• Relays to ADCS → generates admin-level certificate
SECTION 4: SESSION HIJACKING TOOLS
• Hetty: HTTP MITM toolkit
• Kaido: Web security auditing
• Burp Suite, OWASP ZAP: Intercept HTTP requests
• Bettercap: Network MITM attacks
• Wireshark: Capture network traffic
• Fiddler: Debug HTTP/HTTPS
• Checkmarx: SAST
• Invicti, Wapiti, Nessus: Vulnerability scanning
• USM Anywhere: IDS, incident detection
SECTION 5: SESSION HIJACKING
COUNTERMEASURES
1️⃣ Detection Methods
• Manual: Packet sniffing, log analysis
• Automatic: IDS, IPS, ARP monitoring
2️⃣ Protecting Against Session Hijacking
• Use HTTPS / SSH
• Session ID regeneration
• Session timeout
• Random session keys
• Avoid session in URL
• Switch networks (not hub)
• Keep security tools updated
• Defense in depth
• Strong authentication (Kerberos, VPN)
3️⃣ Web Development Guidelines
• Secure cookies (HttpOnly, Secure)
• Validate input
• CSRF tokens
• Encrypt data
5
4️⃣ Web User Guidelines
• Log out after use
• Avoid public Wi-Fi
• Clear cookies
• Use VPN
• Enable 2FA
5️⃣ Detection Tools
• USM Anywhere
• Wireshark
• Nessus
6️⃣ Prevention Approaches
• HSTS: Force HTTPS
• Token Binding: Bind token to client
• DoH: Encrypt DNS queries
• IPsec: AH (auth), ESP (auth + encryption)
7️⃣ Session Hijacking Prevention Tools
• Checkmarx, Fiddler, Nessus, Invicti, Wapiti