Hello, welcome back to the second video. Now.
Let's take a look at a second attack which is known as such in
fixation. So, in this particular attack, what
we were trying to do as an attacker is that
we have a pre-owned session ID.
And that is something we want to fix on the victim side.
So now let's try to look at the actual demo and try to
understand how is it performed?
As you can see, I have got two different
browsers open. On the left hand side is a Chrome browser,
which is an attacker machine. And on
the right hand side is a Firefox browser, which is on
the victim.
So how does this attack actually work?
The moment. I actually visit this website. I
have a session ID from
for myself.
So if you look at the value, it is starts with 2
and ends with be.
So as we looked at the previous attack scenario, we're
using social engineering that
occur was able to hijack session. So similarly, in
the scenario as well. The attacker is going to
use social medium. In order to
send this particular token to the user.
Ideally, the common applications that
are more vulnerable to the scenario would be, which would have a
session ID in the URL, get parameter of itself.
But however, this party application is also vulnerable to
reflect report site scripting. So
we can perform the similar attack and instead of hijacking
the value we can change the value as well.
So, living apart the social engineering tactics as
to how the value is being sent out. Now,
let's assume the fact that the value has been
provided to the victim. So I'm just using
an extension called cookie editor or simplicity.
So we to see that the victim has got a different session.
So as we spoke to a girl
is going to provide its own value to the victim.
So now this is been stored on
the browser.
So when the victim will actually you log in using his
credentials.
We see that he was able to log in to the administrator panel and
the cookie value is the
one that attacker had given to him. So
that occur in normal scenario, just
has to wait for the victim to login. So
now, even without knowing the credentials or
what is it? That hacker seems he has given
his own fixed session ID, which
you wanted the victim to use that's already been set
up and up and
Learning and logged in that, I could just go
back and just refresh the page.
Now, we see that, just by refreshing the page since
the cookie was the same and
it was under revalidated, so we can see
how session fixation at attack work.
Just to reiterate the scenario.
The Tackle will have a legitimate connection initially when
he's trying to fetch the session ID, which
he wants the victim to use.
From that case, it is socially getting tactics which
would be using either. Why fishing or any
such methodology to ensure that particular session ID
is updated on the victim side.
As soon as I attack, which is on the last video, that
is cross-site scripting. When that attack can be
used to ensure that the cookie value is updated.
And after that, it is just awaitin watch game by
The Tackle waits for the victim to log in. And
using the same value. Each is
refreshes his page. And the session is available, too.
As soon as I get on format, the user server,
another attack be in the picture.
Where initially takako sends the
same social engineering tactics, you would send the
fix session ID, which he wants the
victim to use.
From there. The user will actually log
into the server. Without knowing the session ID
was already fixed. And that would be actually authenticated
and authorized by the server and
user will have the session.
And going forward, the victim can use ready-made
available session.
That's it for this video. Thank you.