OK, the last task for us for this section is something called session fixation, and we got a pretty
good example of it inside of our Web application to navigate to it, make sure that you go to session
management floss and under here you want to click on Session Fixation.
And here is our challenge.
So let's see what set we got.
Stage one, your hacker, Joe, and you want to steal the session from Jane, send a prepared email
to the victim, which looks like an official email from the bank.
A template message is prepared below.
You will need to add a session ID or shortened city in the link inside email altered link to include
a session ID.
OK, and we already mentioned or talked briefly about session fixation.
It's simple as predetermining a session ID for someone then that someone could expand our link with
a predetermined session ID.
They log into their account and we can access their account because we do know their session ID and
this is an example of how we can do it.
Let's see what we need to do.
So here is an email and in this email we have this sentence right here.
Please use the following link to verify your account data.
And here we have the link, which is in the statement, so a traffic equals webisodes slash attack and
here are some parameters.
Now, the first thing that I noticed is that this Web code is written incorrectly.
We need to type capital W and capital G the same way that we have it right here.
The second thing that is more important is us adding a session and a session.
It is simply a link parameter.
So we already see some link parameters and they're divided by this character right here.
So all we need to do is to copy that same character and add another parameter at the end.
Let's control.
We need to add this character and then add our side parameter by typing as equals, and here we can
pretty much type any session ID that we want.
For example, let's go with Phi Phi Phi.
This is the session ID that I've chosen.
So now our altered link looks something like this.
We have redcoat slash attack and then these three parameters, which our last one will be the session
ID.
Now, we as a hacker are sending this email to the victim.
Let's send the email.
And we completed stage right now.
Stage two is now you are the victim.
Jane, who received the email below.
OK, so now we're acting like Jane.
If you point on the link with your mouth, you will see that there is an essay included.
Click on it to see what happens.
OK, so let's pretend that this is the email that we got and here's the link that we altered, let's
say that the victim clicks on this link and it leads it to a page where they can log in now here.
Luckily, we got our username and password for the victim, which the username and password is.
So let's type that in right here.
These are the correct credentials that, of course, the hacker wouldn't know.
But we're acting as both the hacker and the victim in this challenge.
And let's log in.
And we've completed stage three.
It is time to steal the sessional use following link to reach goatherds financial.
OK, so in this challenge, we're hackers.
And if we go to the link now, we need to log in to the session.
But we as a hacker don't really know the correct credentials.
So we can type anything right here and see what type of link do we get just by looking at this link
right here.
We already see that there is a section I.D. parameter within the link that says no valid section.
Let's give it a try.
I'm going to go right here and turn on my intercept and I'm going to type in test as username and test
as password, which is, of course, incorrect.
But all we want to do is to intercept this request.
Right now.
We want to change this session ID to the number that we sent to the victim, which in our case or in
my case is five five five.
We don't need to alter anything else.
We can leave the incorrect details.
And if we forward this packet, go back.
We have successfully logged in as Jane Giesbert changing the session ID that we sent to the victim over
that email.
And that is the end of the challenge as it says.
Congratulations, you have completed this lesson.
OK, awesome.
We have covered some of the basic attacks over broken authentication.
And in the next section, we will continue just with different types of the attacks that we call brute
force attacks.
Nonetheless, thank you for watching and I will see in the next lecture.