TL;DR
Session hijacking occurs when an attacker steals or predicts a valid session token to impersonate an authenticated user. Attackers exploit techniques like cross-site scripting (XSS), malware, session fixation, and network sniffing to capture these tokens. Defenses include full traffic encryption, VPN use on public networks, randomized session cookies, and prompt session termination after inactivity.
Understanding session hijacking
A session hijacking attack is a form of impersonation. The hacker gains access to a valid computer session key, and with that tiny bit of information, the intruder can do almost anything an authorized user can.
We'll help you understand what is session hijacking, and we'll explain how you can protect yourself and your data.
What is a session hijacking attack?
A period of communication between two devices (like a computer and a server) is a session. Authentication starts the process, and when it's successful, the server generates a session token that's stored in the user's browser. During session hijacking, that token is stolen or predicted.
With your session ID, your hacker can:
- Take over your session. Anything you're authorized to do on that site, your hacker is also able to do. That could mean transferring money, making a purchase, or changing your password.
- Search for more opportunities. Does logging in on one site (like Google) allow you to work on another site (like YouTube)? Your hacker will find out.
| Technique | How It Works | Key Difference |
|---|---|---|
| Session Hijacking | The attacker steals or predicts a valid session token to take over an active session. | Both the legitimate user and the attacker are working on the same server at the same time (until the program crashes or the user is removed). |
| Session Spoofing | The attacker impersonates the user and starts a new session without the user's knowledge. | The attacker starts a fresh session rather than taking over an existing active one. |
How does session hijacking start?
Servers are designed with security in mind, and it should be difficult for anyone to engage in session hijacking. Unfortunately, breaches are common.
Five known techniques exist, including:
- Cross-site scripting (XSS) attacks. An attacker sends you a seemingly innocent link. You click on it, and malicious code runs. The hacker gains your session key. This approach is considered a top application security risk by the Open Web Application Security Project (OWASP).
- Malware. Your hacker plants a malicious link in an email or on a website. When you're infected, the hacker can steal session keys or otherwise take over your device. Sometimes, hackers use malware to engage in man-in-the-middle or man-in-the-browser attacks, where they can see everything you do on any server.
- Session fixation. The hacker sends you a known session key via a link. When you log in via that link, the hacker has your cookie.
- Session-side jacking. The hacker uses a sniffing tool to read unencrypted traffic that passes between your device and the server. If you're working on a public WiFi, the hacker's job is even easier as your traffic may not be encrypted.
- Session sniffing. Your session ID is sent in an unencrypted state, and your hacker monitors the network to spot it.
Beyond these techniques, hackers can also rely on purpose-built tools to make session capture faster and easier.
What tools do hackers use for session hijacking?
Hackers can also use a variety of tools to capture session cookies and take over sessions. Common examples include:
- Firesheep — A Firefox extension used over public WiFi sessions to copy session cookies on authenticated websites.
- WhatsappSniffer — A platform-specific tool that can bypass normal session protections and take over sessions entirely.
- DroidSheep — A session hijacking tool targeting mobile sessions.
- CookieCadger — A tool used to capture and replay session cookies.
As long as hackers want to take over sessions, hacking development teams will be there to help them.
How can you prevent session hijacking?
Many modern browsers include built-in session hijacking protection. Ensuring that you're using the latest software each time you access the web is a quick and easy way to keep your data secure.
Four other security options include:
- Encrypt all traffic. Ensure that all movement to and from your server is completely encrypted, so no bystander can watch and steal.
- Use a VPN. If you or your employees must do work in public spaces, ensure that your communication is protected with a VPN. Public WiFi is simply too dangerous.
- Randomize session cookies. Set up your server to issue random session cookies, so hackers have a hard time guessing what comes next.
- End sessions promptly. When a session ends, log out. If you're a site administrator, log off users after a period of inactivity.
Frequently asked questions
What is the difference between session hijacking and session spoofing?
The practical risk differs significantly: during session hijacking, the attacker shares your active session in real time, meaning they can act as you while you are still logged in — potentially without you noticing until damage is done. During session spoofing, the attacker starts a fresh session as you, but your own session is not directly disrupted.
How do attackers steal session tokens?
Attackers typically exploit the gap between a user's device and the server — either by injecting malicious code via cross-site scripting (XSS), planting malware, tricking users into authenticating with a pre-set token (session fixation), or passively monitoring unencrypted network traffic to capture the token as it travels.
Why is public Wi-Fi particularly dangerous for session security?
On public WiFi, traffic may not be encrypted, making it easier for hackers to use sniffing tools to read data passing between your device and the server. This enables both session-side jacking and session sniffing attacks, where the attacker can capture your session ID without your knowledge.
What steps can a website administrator take to reduce session hijacking risk?
Website administrators can reduce session hijacking risk by ensuring all traffic to and from the server is fully encrypted, requiring VPN use for employees working in public spaces, configuring the server to issue random session cookies, and automatically logging off users after a period of inactivity.
Can session hijacking affect mobile devices?
Yes. Tools like DroidSheep are specifically designed to target mobile sessions, meaning mobile devices are not immune to session hijacking. Using encrypted connections and avoiding public WiFi on mobile devices are important precautions.
Does using an up-to-date browser help prevent session hijacking?
Yes. Many modern browsers include built-in session hijacking protection. Ensuring that you're using the latest software each time you access the web is a quick and easy way to keep your data secure.
References
OWASP Top Ten. OWASP.
How Firesheep Can Hijack Web Sessions. (November 2010). Dark Reading.
WhatsApp Sniffer Apk Download for Android. WhatsApp Sniffer Apk.
What Is Session Hijacking and How to Prevent It? EC-Council.
