From the course: Programming Foundations: Web Security
Unlock the full course today
Join today to access over 23,200 courses taught by industry experts.
Session hijacking
From the course: Programming Foundations: Web Security
Session hijacking
- Session hijacking is an attack where a hacker steals a user's active session to gain unauthorized access to parts of a website. Sessions store user's data in a file or database on the server. It's more secure to store data in sessions than in browser cookies because the data never leaves the server. It cannot be viewed in transit or in storage. However, as we discussed in the previous movie, a session reference identifier, or session ID, is stored in a browser cookie and like all cookies, is vulnerable to theft. An attacker with a stolen session ID can access all of the data stored in the session. Even worse, they can impersonate a logged-in user. Imagine that a user logs into a web application successfully. Web application stores a bit of data in the session file to remember that the user's logged in. This enables the user to click links and visit other pages without having to re-authenticate each time. I think of it a…
Contents
-
-
-
-
-
-
(Locked)
Types of credential attacks4m 55s
-
(Locked)
Strong passwords4m 1s
-
(Locked)
URL manipulation and Insecure Direct Object Reference (IDOR)4m 43s
-
(Locked)
SQL injection6m 16s
-
(Locked)
Cross-Site Scripting (XSS)6m 15s
-
(Locked)
Cross-Site Request Forgery (CSRF)4m 21s
-
(Locked)
Cross-Site Request protections3m 38s
-
(Locked)
Cookie visibility and theft4m 37s
-
(Locked)
Session hijacking5m 8s
-
(Locked)
Session fixation3m 18s
-
(Locked)
Remote system execution2m 8s
-
(Locked)
File upload abuse2m 59s
-
(Locked)
Denial of service4m 55s
-
(Locked)
-