Menu
I have looked into many threads that discuss preventing Session hijacking & fixation but I feel that there are always details I'm missing out.
What I'm looking for is something with the same principle as what HTML Purifier does against XSS, but in this case against Session hijacking and fixation.
Is there an API or a PHP class made by anyone that covers everything that can be done to prevent Session Hijacking and Fixation?
Or is it better to do it on my own?
Thanks in advance. Regards
235
There are several things you can do to prevent session hijacking and protect your data and identity online, including: Use a VPN. A high-quality VPN can mask your IP address and keep your online activity private and secure. Avoid public or unsecure Wi-Fi networks.
There are five key methods of Session hijacking: Session Fixation. Session Side Jacking. Cross Site Scripting.
A session hijacking attack happens when an attacker takes over your internet session — for instance, while you’re checking your credit card balance, paying your bills, or shopping at an online store. Session hijackers usually target browser or web application sessions.
It can be obtained in a few different ways (more on that later), including by stealing the session cookie or by tricking the user into clicking a malicious link that contains a prepared session ID. Either way, the attacker can take control of the session by using the stolen session ID in their own browser session.
The example shows how the attacker could use an XSS attack to steal the session token. If an attacker sends a crafted link to the victim with the malicious JavaScript, when the victim clicks on the link, the JavaScript will run and complete the instructions made by the attacker.
The attacker, who already has the cookie value, can access the victim’s account. By analyzing the pattern of session IDs, an attacker can predict the session ID of a logged in user and thus hijack his account. For example, consider the below session cookie set by an application.
Session hijacking is when an attacker is able to read a users session cookie, and use that session cookie as their means to access your application. The only way to prevent an attacker from doing that is to use HTTPS for everything. There is no API to use, because there isn't anything the application can do otherwise to prevent someone from stealing the session cookie if they can set up man in the middle situations.
195
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
