CAPEC Definitions

    CAPEC Definitions / CAPEC-593

    CAPEC-593: Session Hijacking

    This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.

    Severity:Very High
    Possibility:High

    Extended Description

    No Extended Description.

    Mitigations

    Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated.

    Relationships with other CAPECs

    CAPEC-21: Exploitation of Trusted Identifiers

    Prerequisites

    An application that leverages sessions to perform authentication.

    Related Weaknesses

    CWE-287: Improper Authentication