Session hijacking is a type of network security attack that relies on "guessing" the ISNs of TCP packets and taking control over communication. The attacker intercepts and retransmits messages such as the communication is still on. The attack is performed using a program which appears as a service to the client and as a client to the server.
Questions tagged [session-hijacking]
118 questions
0
votes
1 answer
How to integrate these pieces of code to protect against session hijacking
I'm using these docs to integrate a certain level of protection against session hijacking (bottom of page).
While I can understand the basics of what the article explains, I'm still new to all this and I'm just not able to pin-point what I should…
binoculars
- 2,016
- 3
- 28
- 46
0
votes
0 answers
Securing my web app with codeigniter: holes?
I'm building a web app and want to add some "decent" level of security. It's not the next generation bankingplatform so an overkill is not necessairy. However, I do want protection against your local neighbourhood hacker, since the app has an…
binoculars
- 2,016
- 3
- 28
- 46
0
votes
2 answers
Checking if a cookie has made it to the client's browser without waiting for the next connection
I am building a session control library that is designed to implement a (limited) form of security on the session store to prevent session hijacking (without SSL).
It works by setting an nonce cookie, which is changed to a random string on every…
topherg
- 3,842
- 3
- 31
- 66
0
votes
2 answers
Avoid session hijacking in site with http
as I know the only way to avoid session hijacking in https ,but some times we don't want to use it. so I think about alternative way for it.
I explain my way,can it be possible or is it good way?
think we have third part server ( I called it Padra )…
Moein Hosseini
- 4,053
- 14
- 61
- 98
0
votes
2 answers
PHP Session Hijacking Detected
I have this code:
if (isset( $_SESSION['user_agent'] )) {
if ($_SESSION['user_agent'] != md5( $_SERVER['HTTP_USER_AGENT'] )) {
die('Session error.');
}
}
Everything works fine. But every time I login (once per 24 hours), I get…
user1453094
- 261
- 2
- 7
- 13
0
votes
2 answers
Whats the error in this python code?
What do i do to solve it?
Terminal output is:
abhi@abhi-desktop:~/Desktop/sslstrip-0.1$ python sslstrip.py --listen=3130
Traceback (most recent call last):
File "sslstrip.py", line 254, in
main(sys.argv[1:])
File "sslstrip.py", line 246,…
Abhijeet Rastogi
- 14,835
- 24
- 73
- 123
0
votes
1 answer
suPHP Security With Sessions
I am trying to better understand suPHP.
I have obviously found the suPHP documentation on google, and have found the generic answers for what it is and does, but I am confused on how it can help with session security and preventing session…
ZAX
- 918
- 3
- 19
- 48
0
votes
2 answers
Securing Sessions using unique information
To Avoid Session Hijacking after a user has logged In , what information can i rely on during login process to validate that indeed the legitimate user. So that someone who intercepts the session to relay will be invalidated
Are their Ip address and…
Deeptechtons
- 10,345
- 23
- 89
- 172
0
votes
2 answers
Using Session_regenerate_id()
Why is it always recommended that session_regenerate_id() should be used before the user's session is created.
As per my perception, session_regenerate_id() should be used once the user session id is created, and we need to re-generate it so as to…
Troy
- 3
- 3
0
votes
1 answer
Does Storing Sessions In Database Prevent Hijacking/Fixation
After many hours of frustration, I've managed to write a script that stores PHP sessions in the database. My question is, does this prevent session hijacking and/or fixation?
Thanks in advance.
user870283
-1
votes
1 answer
How does this sound? Sessions & Cookies?
Cookies and sessions both have pros and cons. But I was thinking, how about when a user logs in it creates a session with their username and password in, but when they register they get given a unique 'access token'.
So when they login it will…
frankmeacey
- 121
- 1
- 3
- 8
-1
votes
1 answer
Hijacking my own session in different browsers
I am trying to get logged in my web application with Firefox while I am logged in with chrome.
I want to use the same cookies I have in chrome, append them in Firefox and find myself logged-in.
Is this the correct way to do so?
OEH
- 530
- 7
- 23
-1
votes
1 answer
Auto login on other tabs when one tab is logged in
Alright I'm trying to test session fixation/hijacking on my localhost.
I'm trying to give my URL with SID from the attacker to the victim and let victim login in that URL. But when the victim login, the attacker refreshed the page and still in the…
Lozy
- 159
- 4
- 11