Menu
So everyone says that sessions have security risks, I want to know what kind of risks are these? What can hackers do with sessions?
This is not about knowing how to avoid attacks, I want to know how hackers are doing it, and what are they doing.
I talk about PHP SESSIONS.
314
“Is a PHP session secure? PHP sessions are only as secure as your application makes them. PHP sessions will allow the client a pseudorandom string (“session ID”) for them to distinguish themselves with, but on the off chance that the string is intercepted by an attacker, the aggressor can imagine to be that client.
Sessions are NOT serverside, they are stored on the clients local machine (you can go in your cookies and look for a cookie called phpssid under your domain name). Yes they can be hacked, and this is in fact a very common method of hacking.
After a user starts a session such as logging into a banking website, an attacker can hijack it. In order to hijack a session, the attacker needs to have substantial knowledge of the user's cookie session. Although any session can be hacked, it is more common in browser sessions on web applications.
The answer by sAc is very good. However, don't rule out "sessions" because of this.
I've successfully deployed custom sessions which, among other things, fixes hijacking, password reversal (md5/rainbow) and (if used correctly) session fixation.
By "successfully deployed" I mean passing penetration testing and (of course) actually being better than the traditional.
There is no "secret" or obscure security; basically, it generates a random (and database-wise unique) number (actually, a guid in my case) per user account and stores the guid+username as the normal method (instead of username+hashed/salted password). Next, it binds this guid with the user's ip address. Not infallible, but using a guid and per-ip already is an improvement over the current session system. Of course, there are flaws which open up after specific targeting (such as ip spoofing+the hijacked guid and username). But in general, it's a way better alternative.
21
Mainly here are the risks:
Consider using OWASP to do against it.
Also have a look at:
PHP Security Guide
93
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
