Session Hijacking
An attack where a threat actor takes over an active user session by stealing or predicting a valid session token or cookie.
Session hijacking, also known as cookie hijacking, is an attack in which a malicious actor takes control of a valid user session by obtaining or predicting the session identifier (typically a session cookie or token). Once the attacker possesses a valid session ID, they can impersonate the legitimate user and perform any action the user is authorized to do — without ever needing to know the user's credentials. The attack exploits the stateful nature of web sessions, where a single token serves as proof of authentication.
Session hijacking can be accomplished through several methods. Network-level interception captures session tokens transmitted over unencrypted connections (a form of man-in-the-middle attack). Cross-site scripting (XSS) allows attackers to execute JavaScript that reads and exfiltrates session cookies. Session fixation forces a victim to use a known session ID controlled by the attacker. Session prediction exploits weak randomization in session ID generation. Malware on the victim's device can directly read browser cookie stores. Side-channel attacks such as BREACH can extract session tokens from compressed HTTPS responses.
The consequences of session hijacking include unauthorized access to accounts, data theft, financial fraud, and privilege escalation. A hijacked administrator session can give attackers complete control over an application. Defense requires a multi-layered approach: encrypting all traffic with HTTPS, setting the HttpOnly and Secure flags on session cookies, implementing session timeouts and rotation, binding sessions to client fingerprints (IP address or device characteristics), and deploying robust XSS prevention measures. Anomaly detection that flags unusual session behavior — such as geographic impossibility or device changes — provides an additional layer of protection.
Session hijacking can be accomplished through several methods. Network-level interception captures session tokens transmitted over unencrypted connections (a form of man-in-the-middle attack). Cross-site scripting (XSS) allows attackers to execute JavaScript that reads and exfiltrates session cookies. Session fixation forces a victim to use a known session ID controlled by the attacker. Session prediction exploits weak randomization in session ID generation. Malware on the victim's device can directly read browser cookie stores. Side-channel attacks such as BREACH can extract session tokens from compressed HTTPS responses.
The consequences of session hijacking include unauthorized access to accounts, data theft, financial fraud, and privilege escalation. A hijacked administrator session can give attackers complete control over an application. Defense requires a multi-layered approach: encrypting all traffic with HTTPS, setting the HttpOnly and Secure flags on session cookies, implementing session timeouts and rotation, binding sessions to client fingerprints (IP address or device characteristics), and deploying robust XSS prevention measures. Anomaly detection that flags unusual session behavior — such as geographic impossibility or device changes — provides an additional layer of protection.
Examples
- An attacker uses a packet sniffer on an unsecured Wi-Fi network to capture a user's session cookie and access their email account.
- An XSS vulnerability on a website allows an attacker to steal session tokens from other users visiting the affected page.
- An attacker predicts the session ID pattern of a web application and generates valid session tokens to access user accounts.
Prevention
- Set session cookies with HttpOnly, Secure, and SameSite attributes to limit exposure.
- Implement session rotation after authentication and at regular intervals during active sessions.
- Enforce HTTPS on all pages and implement HSTS to prevent session token interception.
- Bind sessions to client characteristics and detect anomalies like sudden IP or device changes.