‫So Session ID has to be renewed by the application when the user logged in, if the Session ID is not
‫renewed, we can perform the session fixation attack.
‫The attack scenario is as follows.
‫Attacker visits the application, which has inadequate session management and gets a valid session token,
‫then he prepares a link to the application, which contains the session token and sends a link to the
‫victim.
‫For instance, in a phishing email since the link is to a trusted website, Victim does not suspect
‫the link and clicks it and logs into the application using his own credential.
‫The application identifies a victim, but doesn't give him a new session ID.
‫So after this time, when the attacker visits the application with the same session ID, he is now the
‫victim on the application.
‫Let's see the session fixation attack in action.
‫We're going to use OWASP Broken Web Applications and Carly for this demo.
‫First go to OH&S Broken Web Applications page using its IP address or the domain name.
‫If you do find it in the host file, I use OWASP BW Wacom domain name, which is mapped with the IP
‫address of the host machine.
‫On the main page of the OWASP BWR app, click OWASP Web Goat Link Authenticate using Google Lost Credential.
‫Click the Start Web goat button at the bottom of the page.
‫Now in the tree of the left hand side of the page, expand session management flaws node and select
‫the session fixation length.
‫In this scenario, victim Jane has an account in Goat Hill's financial and the web application of the
‫finance service is vulnerable to session fixation and the first day Joe Hacker Joe.
‫You'll prepare a phishing email as if it's sent by Goat Hill's financial, and it will contain a link
‫where the session is fixed in the explanation stage of stage one.
‫On the web page, we know that the name of the Session ID variable is inside.
‫Find the link inside the prepared email and change it with a valid link first.
‫Then put an ampersand at the end of the URL to add a new parameter and type as ID equals session for
‫Jane.
‫Now, session for Jane is an arbitrary session ID given by me.
‫You can give it anything you want.
‫Just don't forget it to send the email to the victim, Jane, click the Send Mail button.
‫Now we're in stage two.
‫We are the victim, Jane, in this stage, who has got an email from Google's Financial.
‫The email contains a link.
‫We bring the mouse pointer on the link, we see the URL address that the link points to.
‫It is a legitimate Goat Hill's financial link, so the victim clicks the link with no doubt, but the
‫side is set by the hacker at this point.
‫In stage three, you are still the victim, Jane.
‫When Jane clicks the link, the log in page of Goat Hill's financial opens as it's seen in the explanation
‫of stage three.
‫You can log in to the app using Jane Slash Tarzan credential.
‫Did you see the session ID parameter inside the URL, enter the username and the password and click
‫log in.
‫Now we were in the final stage.
‫We are now hacker Joe.
‫It's time to steal the session of Jane.
‫Try to go to the Web page of Goat Hill's Financial, its hacker, Joe, does not have a valid session.
‫The app redirects him to the login page.
‫Look at the URL.
‫The session ID of Jack is no valid session.
‫Change it with the session ID, with the one you sent to victim Jane in my demo, it was session for
‫Jane and hit.
‫Enter now as hacker Jo, you're inside the Goat Hill financials website as Jane.