the victim’s browser. The attacker then steals the authentication cookie of the victim or does other malicious activities.

The attack usually follows these steps :

• The attacker writes a script such that when a user is already logged in to the legitimate web server and clicks on a link, the script starts execution on the victim’s browser and sends the authentication cookie of the user to the attacker.
• The attacker keeps the scripts on a malicious server, uses some social engineering techniques, and sends the link to the victim.
• The victim is already logged in to the legitimate server and clicks on the link.
• The script starts execution on the victim’s computer. Session information placed in the cookie is transferred to the attacker.
• The attacker now exploits the session information to log in to the legitimate server and impersonates the victim.

Using Malware

Here, the attacker infects the victim’s computer with malware and then steals the session cookie.

Just to give an example, the attack may follow these steps:

• The victim installs software from an untrusted source.
• The victim’s computer is infected with a browser hijacker.
• The malware changes the security settings of the attacker’s browser.
• When the victim logs in to the server, the malware steals the session cookie and transfers it to the attacker.
• The attacker can now log in to the server and impersonate the victim.

How to prevent session hijacking attacks?

We can take a couple of steps to prevent session hijacking attacks.

• Web applications should use SSL/TLS to transfer sensitive data. This will encrypt the data and make it difficult for the attacker to steal session cookies or any other information by sniffing the network traffic.
• Web applications should use very long random numbers as a session key so that it becomes difficult for the attacker to guess the session key.
• After a user authenticates himself, the server should regenerate the session key and should not use the same session key as that of the unauthenticated user. In that way, it will be difficult for the attacker to guess the session key after the user logs in.
• Web applications should use secondary checks like matching the IP address with that of the previous session, etc, to increase security.
• Web applications can change the cookie with each and every request made by the user’s computer. This will limit the attacker to a great extent.
• And, users should always log out of the web applications as soon as they are done.

The above article gives a very brief overview of session hijacking. Interested readers who want to know more about different web application vulnerabilities and their preventive measures may want to refer to the book “Web Application Vulnerabilities And Prevention.”

Security Fundamentals Practice Tests

The Security Fundamentals Practice Tests test one’s fundamental knowledge of cyber security. The practice tests are good for those who are preparing for various certification exams like the CCNA, CCNP, or CompTIA. They are also good for students and IT/security professionals who want to improve their understanding of cybersecurity.