How to hijack a session?

Question

Despite the blatant title of the question, this is actually for a genuine purpose.

My site uses PHP code like this:

    $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";

I'm really trying to think like a hacker and figure out how I can alter this value. I've read articles talking "about" session hijacking, but being vague about how that can be done...

Answer 1

Basically when you hijack someones session you take their sessionID and pretend its your own. Usually the sessionID is transferred in the cookie, meaning that if you can access the other parties cookie you can just put it in your own cookie and you've stolen their session.

This can be done in several ways, for example by sniffing the wireless network and looking at the HTTP packets being transfered or by XSS attack where you can tell the victims browser to reveal their cookie information to you.

I would like to mention that the example you describe in your question may also be vulnerable to SQL-Injection. If I change my cookie's sessionID to

asdf' OR 1=1-- 

I would most likely be authenticated as a valid user. To prevent this you have to make sure you have proper sanitizing on dirty data coming from your clients before you use the data for anything.

Answer 2

If you're interested in a hands on demonstration, Twitter is a very good example of how easily it's done. You'll need:

• Two Computers
• Firefox with Firebug (obviously there are other options, but these are popular and easy to get)
• A Cookie Editor, like Advanced Cookie Manager (again, easily installable add-on through Firefox)

On computer A with firefox and firebug, log in to your twitter account on the non-https site. Once logged in, open up Firebug and look at the "GET twitter.com" line. When you expand it look under the Response Headers section and find Set-Cookie. In there you'll find a cookie called _twitter_sess. Highlight and copy the value (all the way until the semi-colon).

Now open up Firefox with the advanced cookie manager on computer B and go to the twitter login page. Open the Advanced Cookie Manager and filter for twitter.com. Once you find the twitter.com domain and its list of cookies, you'll see a cookie called _twitter_sess. Delete it. Now make a new cookie with the name "_twitter_sess", path "/" and "Value" the value of _twitter_sess from the other computer. Save the cookie.

Now close the cookie manager and go back to the twitter login page, refresh the page and bam, you're in.

Now just devise some clever way to get someone else's session (open wifi, xss) and that's one way of how session hijacking is done.

Answer 3

Karrax's code is an SQL Injection attack (which your code is vulnerable to - this needs fixed) not a session hijacking attack.

$select="select id from tableA where user_id='"
    .mysql_real_escape_string($_SESSION['sess_user_id'], $db_handle)
    ."'";

In session hijacking, Bob steals the value for the session id you assigned to Alice. This might have been as a result of a MITM attack on the HTML stream, network sniffing, a CSS bug which allowed him to embed some javacript onm your site, or other methods.

It's important not to loose sight of session fixation problems - even if you set the SSL and HTTP only flags on a cookie, AND set use_only_cookies that does not resolve the problem where Bob attacks Alice's computer before she accesses your site and sets a specific value for the session id. Bob can then set the same value on his computer and his requests are bound to the same session as Alice. So when you authenticate you should generate a new session id - see session_regenerate_id()

Answer 4

Session hijacking usually involves stealing a cookie from a user. For example Firesheep is a plug in for Firefox that steals sessions over unsecured Wifi. HTTP is a stateless protocol so the best we can do to authenticate people is with cookies.

The PHP code you have in your question is an example of code that is could be susceptible to SQL injection. It is usually best practice to sanitize variables before putting it in a query like that.