Hello everyone. Welcome back. As I cover the
different types of session, hijacking and in-depth, Hands-On
over. Moral tone model 3, let's
take an overview about the types.
So, predominantly all the attacks are
going to be broken into two main categories. The
first category is application-level hijacking. So
when we talk about application hijacking, we are
going to talk about the web application, which
runs over HTTP and serves up an
HTML. Document.
There are multiple ways and classes of session, hijacking, that
can be performed against the web.
Similarly, the second type would
be the network level in this particular scenario. We
are talking more about different types of protocol such
as DNS, TCP, UDP,
and so on.
Just to give an overview of the different type of
attacks, over the web and network. So
the first one would be man the middle which
is nothing but the scenario where the
user is trying to sniff out the
user session over HTTP session fixation.
So session fixation is where the attacker actually
provides a session ID to the user and
then they pull out the user data back.
Similarly, we will be looking at something similar
known as a session ID, brute force in
which we are trying to actually manipulate
and generate a session ID, which would be worried
by the servo and in response. It will
grant us the permission to take over the session. One
of such attack, vectors would be cross-site, scripting in
which will be taking a look at, how
do we inject JavaScript that dispels a
JavaScript? Which would in turn?
Execute a set scripting vectors and
how do we hijack? Your
sessions?
Such intonation is a scenario where the
attack of for your profile and
gives you the entire session to the user. Just
expecting them that they enter some
sort of data and the attacker can then obtain the
session, ID itself. So the
next attack Vector B man-in-the-browser, so
in which we are talking about malware's that are
injected and this is just one such attack
scenario that can.
Performed by man-in-the-browser and we
try to hijack. The you session.
Now, just taking some sort of scenarios over
the network could be sniffing again in
which we use tools such as Wireshark. The
expectation is such that. The attacker is also sitting
on the same network and is trying to sniff out the network packets
and identifying the session IDs.
So, predicting the sequence is also such scenario in
which we are trying to perform session
fixation itself in which we are going to
enumerate and expect application.
Except the particular scenario will
also be taking a look at protocol such as UDP and
how and what tools can be used in order to
perform. The jean jacket IP spoofing is one,
such Vector in which an attacker is
trying to spoof.
And IP maybe that's how the application or
the network is being configured. In order to
accept or authenticates or user based on
a specific IP. So we will see such Tools
in which we can use and impersonate another
usip.
One such protocol in which we will be taking a look at telnet.
So we will see the
type of tools that can be used in order specifically
to hijack. Telnet sessions.
And we'll also be taking a look at DNA sessions as well as to
how does a DNS protocol work and what are the tools that
are capable enough in order to hijack? A DNS session
similar to IP spoofing will
also take a look at the are spoofing in which
will try to figure out the tools that are capable enough to
simulate a physical hardware and generate custom
Hardware addresses, and that
can be used in order to perform a poisoning.
And lastly, we also take a look at an SSL strip attack in
which how an attacker forging a
network can actually strip out an SSL connection and
just expecting the
victim that is already on SSL, secure connection. But
in reality, these able to sniff out
the actual traffic in plain text.
We'll also take a look at the different tools. That would
be used for our Hands-On sessions as
for this video. Thank you.