Attacking Session Management Juliette Lessing

Chapter 7
Attacking Session Management
Juliette Lessing
Session management
Enables the application to uniquely identify

a given user across a number of different
requests.
Prime target for malicious attacks against

application.
Encountered defects.
Two types of weaknesses
Weaknesses in Session Token

Generation
Weaknesses in the handling of session

tokens throughout their lifecycle.
Generation
Meaningful tokens (1)
Created using a transformation of the
users user name or other info
associated with them
But actually:
Exhibit some structure allowing an attacker
to understand their function and means of
generation.
Components:
User name
E-mail address
Clients IP address
Hack steps:
Obtain single token from the application, modify it to determine validity. Change tokens
value one byte at a time and check whether application is still accepted. Are some
portions not required to be correct, exlude them.
Log in as several different users at different times and record the tokens received from the
server.
Analyze the tokens for any correlations that appear to be related to the username and
other user-controllable data.
Analyze the tokens for any detectable encoding or obfuscation.
If any meaning can be reverse engineered from the sample of session tokens, guess the
tokens, find a page of the application that is session-dependent, and make large numbers
of requests to this page using these guessed tokens. Monitor the results for any cases
where the page is loaded correctly, indicating a valid session token.
Generation
Predictable tokens (1)
Contain sequences or patterns
Arise from 3 different sources:
1. Concealed sequences
2. Time dependency
3. Weak random number generation
1. Concealed sequences

2. Time dependency Attack:
Start polling the server to obtain new session tokens in quick
succession
Monitor the increments in the first number. Increases more
than one? Token has been issued by another user
We know upper and lower bounds of second number which
was issued to them
brute-force attacks in order to successfully access a
protected page
Running this scripted attack continuously will enable us to
capture the session token of every other application user.
When an administrative user logs in, we will fully
compromise the entire application.
3. Weak random number generation
This algorithm takes the last number generated,

multiplies it by one constant, and adds another
constant, to obtain the next number. The number is
truncated to 48 bits, and the algorithm shifts the result
to return the specific number of bits requested by the
Handling
Disclosure of tokens on the network (1)
Weaknesses occur when:

Some applications elect to use HTTPS to protect the users
credentials during login but then revert to HTTP for the
remainder of the users session
Some applications use HTTP for preauthenticated areas of
the site, such as the sites front page, but switch to HTTPS
from the login page onwards.
Disclosure of tokens on the network (2)
Hack steps:
Walk through application in normal way and identify login functions and transitions
between HTTP and HTTPS communications
Are HTTP cookies used as transmission mechanism? Verify whether secure flag is
set
Determine whether session tokens are ever transmitted over an unencrypted

connection. Yes? Regard them as vulnerable to interception
Verify whether a new token is issued following login, or whether a token transmitted
during the HTTP stage is still being used to track the users authenticed session
Verify whether server is listening on port 80. If so, visit any HTTP URL directly from
with an authenticated session and verify whether the session token is transmitted
In cases where a token for an authenticated session is transmitted to the server over
HTTP, verify whether that token continues to be valid or is immediately terminated by
the server.
Handling
Disclosure of tokens in logs
causes of session tokens appearing in

system logs
Handling
Vulnerable session termination (1)
Some applications do not provide effective
logout functionality:
A log-out function is not implemented
The logout function does not actually cause the server to
invalidate the session
When a user clicks Logout, this fact is not communi-
cated to the server at all, and so the server performs no
action whatsoever.
Vulnerable session termination (2)
Hack steps:
Investigate whether session expiration is implemented on the
server side
Determine whether a logout function exists and is prominently

made available to users. If not, users are more vulnerable
because they have no means of causing the application to
invalidate their session.
Where a logout function is provided, test its effectiveness.

After logging out, attempt to reuse the old token and
determine whether it is still valid. If so, users remain
vulnerable to some session hijacking attacks even after they
have logged out.
Handling
Client Exposure to Token Hijacking
Hack steps (1):
Identify any cross-site scripting vulnerabilities within the

application and determine whether these can be exploited to
capture the session tokens of other users
If the application issues session tokens to unauthenticated,
obtain a token and perform a login.
Hack steps (2):
Check whether the application is willing to return to the login

page eventhough you are already authenticated, sumbit
another login as a different user using the same token. If it
does not issue a fresh token, it is vulnerable to session
fixation
Identify the format of session tokens used by the application.

Modify your token to an invented value that is validly formed,
and attempt to login. If the application allows you to create
an authenticated session using an invented token, then it is
vulnerable to session fixation.
Securing Session Management
In order to perform session management in a

secure manner:
1. Generate strong tokens

2. Protect Tokens throughout Their Lifecycle
should only ever be transmitted over HTTPS
never be transmitted in the URL
Logout functionality should be implemented
Session expiration should be implemented after a
suitable period of inactivity (e.g., 10 minutes).
Etc.
Securing Session Management
Per-page Tokens
New page is created every time
Prevents session fixation attacks

Attacking Session Management Juliette Lessing

Uploaded by

Copyright:

Available Formats

Attacking Session Management Juliette Lessing

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Attacking Session Management Juliette Lessing

Uploaded by

Copyright:

Available Formats

Chapter 7

Attacking Session Management

Enables the application to uniquely identify

Prime target for malicious attacks against

Weaknesses in Session Token

Weaknesses in the handling of session

Analyze the tokens for any detectable encoding or obfuscation.

This algorithm takes the last number generated,

Weaknesses occur when:

Determine whether session tokens are ever transmitted over an unencrypted

causes of session tokens appearing in

Determine whether a logout function exists and is prominently

Where a logout function is provided, test its effectiveness.

Identify any cross-site scripting vulnerabilities within the

Check whether the application is willing to return to the login

Identify the format of session tokens used by the application.

In order to perform session management in a

1. Generate strong tokens

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.