Welcome back. Let's take a look at the next Factor.
Called as session donation. Unlike
previous attack scenarios where the attacker was
trying to hijack the session itself. This is
more of a fishing based on tap. This attack is
something to be aware of because in this
attack,
The main purpose is to gain access to sensitive information
from the web.
As the name suggests, the keyword donation is
quite significant over you. Because the attacker is
trying to donate an existing profile such
that the victim believes its
own, and is going to fill out some information now,
let's let's take an example.
Taking a scenario where an attack of as created a
fake profile for Tom, Tom is
being the victim of you. So what he has done
is that he has restored and account or we
have of Tom, and as you can see
on the homepage that's a user profile, which
is asking for sensitive information such as
credit card.
So, main intent with attacker is to
create each account based on the victim.
Such that the victim believes that it
is his own account at he is willing to
send out some sense information.
Now, patient attack scenarios as we have seen in the previous
slides, that could be a combination of
attacks that could be used to gain access as
well. Maybe there's
a website which is actually available to cross-site scripting. So
the user will actually create
a profile and expecting the user to access it
through fishing mechanisms and
hoping that he can perform additional attacks in
order to gain access to the account sufficient.
Or exploiting process scripting or any
search scenarios for table, but just
focusing on the main intent of this attack. It is to ensure
that this account has been created by the attacker
and not by the victim and making
sure that the victim actually believes it is his own account.
So we do a scenario where the attacker was able
to fool the victim in order so
that you can click on the link and believing. It
is its own account and expecting the user to
update the profile. So this could be such a
scenario where the attacker just all go victim saying that hey
looks like a profile is incomplete. Please update
the profile in order to access some
deals. So it could be one such scenario, but
the main expectation is to
That though, victim accesses the account either
by loophole on the website. Such
that just by clicking on the URL, such in this generated
and the user is already logged in. So
since was his profile was
created by the attacker and is donating it to
the victim. Hence the name session donation.
Just to reiterate that occur is actually creating
a fake profile on the website such
that the user is actually being social engineer,
in order to access that particular profile.
And by accessing that the user might
want to believe that has its own account, and is
wanting fill out those sensitive divisions. And
once the user fills out the profile or ads
in sense of information, then it is up
to the user.
To just access the same account since he was the owner in
real sense. Now, you can access that
account and gain access to any sensitive information based
on whatever the website is incident intended
to do so.
There is for this video. Thank you.