Click Here to download this article
- Articles
- Authors
- Blogs
- ISA Server Articles
- Links
- Message Boards
- Newsletter
- RSS
- Security Tests
- Services
- Software
- White Papers
Session Fixation Vulnerability in Web-based Applications
- Published: Dec 20, 2002
- Updated: Dec 20, 2002
- Section: Network Security Library :: Web Security
- Author: ACROS Security
- Printable Version
-
Adjust font size:
- Rating: 3.3/5 - 18 Votes
Many web-based applications employ some kind of session management to create a user-friendly environment. Sessions are stored on server and associated with respective users by session identifiers (IDs). To prevent attackers hijacking users' identities by obtaining session IDs, web servers are employing techniques for protecting session IDs from three classes of attacks: interception, prediction and brute-force attacks. This paper reveals a fourth class of attacks against session IDs: session fixation attacks.
Featured Links*
Become a WindowSecurity.com member!
Discuss your security issues with thousands of other network security experts. Click here to join!