Session Hijacking

Session hijacking is a sophisticated cyberattack method aimed at exploiting a valid computer session or session key to gain unauthorized access to information or services within a system. It is categorized as an active attack because it tampers with the data in transit or disrupts communication between systems to bypass security controls.

Attacker hijacks valid TCP/IP communication session.

Pasted image 20250615180918.png

Session Hijacking Concepts and Mechanisms

In the context of web applications, session hijacking often refers to the theft of a magic cookie used to authenticate a user to a remote server. These HTTP cookies, used to maintain sessions on many websites, can be easily stolen by an attacker using an intermediary computer or access to the saved cookies on the victim's computer.

Session hijacking attempts to steal, predict, or negotiate the control mechanism of a real, valid web session to gain access to authenticated parts of a web application.

Session hijacking is also listed as an attack vector for VoIP systems and mobile platforms.

Techniques and Types of Session Hijacking

Session hijacking attacks can generally be classified into two main areas: Application-Level and Network-Level.

1. Application-Level Session Hijacking Techniques

Application-level attacks focus on compromising the session management mechanism. Attackers attempt to capture valid session cookies and IDs in established sessions.

Technique	Description
Session Token Prediction	Attackers determine a pattern between session IDs that the server uses. By successfully guessing previous and next session IDs, the attacker can perform malicious activities. Predicting the Initial Sequence Number (ISN) in a TCP connection is a related method used to hijack the connection.
Session Fixation	This is a class of Session Hijacking where the attacker fixes an established session on the victim's browser before the user logs in. The attacker tricks the victim into authenticating the application using the attacker's known Session Identifier. If session IDs are exposed in the URL, the web application is vulnerable to session fixation attacks.
Session Replay	Attackers capture user session IDs from websites and services and then reuse them to gain unauthorized access to the user account.
Session Token Tampering	The attacker gains the previous and next session ID, allowing them to tamper with the session data and engage in further malicious activities.
Cookie/Session Poisoning	Attackers modify cookie data to gain escalated access or assume the identity of another user. This involves modifying session-specific data such as user IDs, passwords, or account numbers stored in cookies.
Pass-the-Cookie Attack	Attackers obtain a clone of a cookie from a user's browser and inject it to establish a session with the target web server, bypassing authentication controls.
Session Donation	A social engineering technique where an attacker creates an account and convinces the victim to authenticate using the attacker's session ID, linking the victim's actions (e.g., payment details) to the attacker's account.
Cross-Site Scripting (XSS) Attack	Attackers exploit XSS vulnerabilities to steal session cookies/tokens.
QRLJacking	This social engineering attack exploits the QR Code Login method in web applications to hijack login sessions and gain unauthorized access. The attacker clones a legitimate QR code and tricks the victim into scanning it on a phishing page, sending device IDs and login credentials to the attacker's malicious web server.
Man-in-the-Middle (MiTM)	In web servers, an attacker sniffs the communication between a user and the web server to steal session IDs.
Sidejacking	A technique used to capture valid session cookies and IDs.

2. Network-Level Session Hijacking Techniques

Network-level attacks typically involve intercepting or monitoring network traffic.

TCP-IP Hijacking: This occurs when an authorized user gains access to another user's genuine network connection to bypass password authentication. A connection is established using a three-way handshake (SYN, SYN/ACK, ACK). Hijacking often relies on predicting the Initial Sequence Number (ISN) or by utilizing a Man-in-the-Middle (MITM) attack, which involves sniffing the network.
Blind Hijacking: When source routing is disabled, the attacker injects malicious data into intercepted communications in a TCP session. It is called "blind" because the attacker cannot see the response from the client or server, forcing them to guess the outcome.
Sniffing and Eavesdropping: Attackers exploit the intersection and monitoring of network traffic (unencrypted or weakly encrypted) to sniff credentials, passwords, session cookies, and other sensitive data.
QRLJacking: While application-focused, the authentication process ultimately compromises the device via network means, allowing the attacker to steal information such as the victim's current GPS location, device ID, IMEI, and SIM card details.
aLTEr Attack: This attack on LTE devices involves installing a virtual (fake) communication tower to interrupt and manipulate data transmission between the user and the real tower, attempting to hijack the active session.

Tools Used in Session Hijacking

Tools are used to automate the session hijacking process and test the randomness of session tokens:

burpsuite: A web security testing tool often used to inspect and modify traffic, capture data, and contains the Sequencer tool to test the randomness of session tokens, aiding in prediction.
JHijack
Ettercap
Wireshark: A network protocol analyzer used to sniff network traffic and capture session IDs.
Tamper Dev: Allows the interception and editing of HTTP/HTTPS requests sent by the browser to find input gates for attacks.
mimikatz: Can be used to extract encrypted cookies.

Session Hijacking Process

Session hijacking can be divided into three broad phases.

Tracking the connection

The attacker uses a network sniffer to track a victim and host or uses a tool such as nmap to scan the network for a target with a TCP sequence that is easy to predict

After identifying a victim, the attacker captures the sequence and acknowledgment numbers of the victim because TCP checks these numbers
The attacker then uses these numbers to construct packets.

Desynchronizing the connection

A desynchronized state occurs when a connection between a target and host is established, or stable with no data transmission or the server’s sequence number is not equal to the client’s acknowledgment number, or vice versa.

To desynchronize the connection between the target and host, the attacker must change the sequence number or acknowledgment number (SEQ/ACK) of the server

For this purpose, the attacker sends null data to the server; consequently, the server’s SEQ/ACK numbers advance, while the target machine does not register the increment
For example, before desynchronization, the attacker monitors the session without any interference, following which they send a large amount of null data to the server
These data change the ACK number on the server without affecting anything else, thereby desynchronizing the server and target.

Another approach is to send a reset flag to the server to break the connection on the server side

Ideally, this occurs in the early setup stage of the connection
The attacker’s goal is to break the connection on the server side and create a new connection with a different sequence number
The attacker waits for a SYN/ACK packet from the server to the host
On detecting a packet, the attacker immediately sends an RST packet and a SYN packet with identical parameters, such as a port number with a different sequence number, to the server
The server, on receiving the RST packet, closes the connection with the target and initiates another one based on the SYN packet but with a different sequence number on the same port
After opening a new connection, the server sends a SYN/ACK packet to the target for acknowledgement
The attacker detects (but does not intercept) this packet and sends an ACK packet to the server
Now, the server is in the established state
The aim is to keep the target conversant and ensure that it switches to the established state on receiving the first SYN/ACK packet from the server
Consequently, both the server and target are desynchronized but in an established state
An attacker can also use a FIN flag, but this will make the server respond with an ACK packet, thus revealing the attack through an ACK storm
The attack is revealed because of a flaw in this method of hijacking a TCP connection
While receiving an unacceptable packet, the host acknowledges it by sending the expected sequence number
This unacceptable packet generates an ACK packet, thereby creating an endless loop for every data packet
The mismatch in SEQ/ACK numbers results in excess network traffic

with both the server and target attempting to verify the correct sequence

Because these packets carry no data, retransmission does not occur if the packet is lost
However, because TCP uses IP, the loss of a single packet ends the unwanted conversation between the server and target.

An attacker can add a desynchronizing stage to the hijack sequence to deceive the target host

Without desynchronizing, the attacker injects data into the server while keeping their identity hidden by spoofing an IP address
However, the attacker should ensure that the server responds to the target host as well.

Injecting the attacker's packet

Once the attacker has interrupted the connection between the server and target, they can either inject data into the network or actively participate as the man in the middle, passing data from the target to the server and vice-versa while reading and injecting data at will.

Session Hijacking Countermeasures

Countermeasures are generally divided into network configuration defenses and session management best practices.

Network and Encryption Countermeasures

To protect against session hijacking, especially those relying on sniffing:

Encryption: Encrypt all network traffic using protocols such as IPsec, TLS, SSH, and HTTPS. Ensure web traffic is encrypted with SSL/TLS.
VPNs: Use Virtual Private Networks (VPNs) to create an encrypted tunnel for secure private communication over public networks.
Filtering: Use Ingress and Egress filtering to block spoofed IP packets.
MAC Filtering: Implement MAC address filtering to allow only authorized devices onto the network.
Promiscuous Mode Detection: Detect network interface controllers (NICs) running in promiscuous mode.
Secure Protocols: Use secure versions of communication protocols such as SSH instead of Telnet, and HTTPS instead of HTTP.

Session Management and Application Countermeasures

Developers and administrators should implement robust session management practices:

Random Session IDs (ISN)

Use long, random session identifiers to prevent prediction and guessing. Employ random initial sequence numbers (ISNs) to prevent IP spoofing attacks based on sequence number prediction.

Server-Side Tracking

Use server-side session ID tracking and match connections with parameters such as timestamps and IP addresses.

Authentication

Implement multi-factor authentication (MFA). Do not rely solely on IP-based authentication.

Ensure cookies are only sent over HTTPS by setting the Secure attribute.
Prevent access to cookie data via JavaScript by setting the HttpOnly attribute.
Avoid storing sensitive data in client-side cookies; instead, use a session identifier and store the sensitive data server-side.

Session Management

Avoid exposing session IDs in the URL.
Implement session timeout to automatically lock the session after a specified period of inactivity.
Implement proper login and logout procedures and ensure the session value is invalid after logging out.

Secure Coding

Use secure session management techniques, including random session token generation. Use safe APIs that offer a parameterized interface or avoid the use of the interpreter completely.

Client-Side Security

Clear stored cookies from the browser regularly/automatically upon termination.