📖 What is Session Hijacking?
Session Hijacking is the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system. This is typically achieved by stealing a session token or cookie, allowing the attacker to take over the user's authenticated state.
"This is different from session fixation. In hijacking, the session is already established; in fixation, the attacker forces a known session ID on the user."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Session Hijacking?
- ▸ Session Tokens are unique identifiers assigned by servers to track authenticated users; stealing these allows an attacker to impersonate the user without credentials.
- ▸ Man-in-the-Middle (MITM) attacks, such as ARP spoofing, allow attackers to sniff unencrypted session cookies from network traffic on insecure Wi-Fi networks.
- ▸ Cross-Site Scripting (XSS) is a primary vector for hijacking, where malicious scripts steal cookies from the browser's storage and send them to an external server.
- ▸ Mitigation strategies include implementing the HttpOnly and Secure flags on cookies to prevent JavaScript access and ensure transmission only over encrypted channels.
- ▸ Session timeouts and absolute expiration limits reduce the window of opportunity for an attacker to use a stolen token before it becomes invalid.
🎯 How does Session Hijacking appear on the PT0-002 Exam?
You may be asked to analyze a network capture where a user's session cookie is transmitted in cleartext over HTTP, allowing an attacker to replay the token.
A scenario might describe an attacker using a stored XSS vulnerability to exfiltrate a session ID to a remote listener, effectively bypassing the login screen.
Expect questions where you must recommend the most effective defense against cookie theft, such as implementing HSTS and setting the HttpOnly attribute on all session cookies.
❓ Frequently Asked Questions
Does using HTTPS completely prevent session hijacking?
No. While HTTPS prevents sniffing via MITM, it does not protect against XSS attacks that steal cookies directly from the browser or session hijacking via malware on the client's machine.
What is the difference between session hijacking and session side-jacking?
Side-jacking is a specific type of hijacking where the attacker sniffs the session cookie over an unencrypted connection after the user has already authenticated via a secure portal.