‫Now, as we mentioned before, HTP is a stateless protocol that means to request sent from the same
‫client has absolutely no relation, but today the websites are mostly interactive and status information.
‫That is the information that is required for the user to be recognized during a HTTP request is of vital
‫importance because the HTTP protocol does not contain such information by its design, software engineers
‫have developed their own methods to provide session management.
‫The most important and most widely used of these methods is that unique session information generated
‫by the server is sent to each client individually, and the clients introduce themselves to the web
‫server and hence the web application using this unique information in following HTTP requests, while
‫session management had to be implemented by developers in the past.
‫Most of the tasks are now handled by application servers.
‫And so the developers have been saved from such an important and difficult responsibility, but don't
‫give up hope.
‫Developers still have to manage some important tasks of session management, such as starting and ending
‫the session.
‫Mistakes done in session management allow us to perform some attacks.
‫We will see the most important of these attacks in this section.
‫There are a few methods to manage sessions such as you URL rewriting hidden form field, special http
‫headers or SSL keys.
‫But the most popular session management method is the use of cookies when the client sends a request
‫to the application.
‫If the client does not have a valid session token at this time, the server returns the session token
‫inset cookie header.
‫After this time, a client sends its requests with this session token in the cookie and the server identifies
‫the client with this information.
‫Now, as we said before, the use of cookies is the most popular session management method, and cookies
‫contain session tokens.
‫Session tokens contain session IDs and some other information.
‫Session IDs are the unique identifiers that are used to identify the users.
‫One of the attacks against session management is that the session information generated on the server
‫side is predictable.
‫This is usually caused by the following situations.
‫First, using sequential session IDs, it's not seen that much today.
‫Second, using weak random number generators.
‫There are some weak random number generators that just shouldn't be used anymore.
‫These methods are not intended to generate unique numbers.
‫And third, using short session IDs.
‫If this session ID is not long enough, it might be the subject of a brute force attack.