From the course: Certified Ethical Hacker (CEH)

Unlock this course with a free trial

Join today to access over 24,800 courses taught by industry experts.

Attacking session management mechanisms

Attacking session management mechanisms

From the course: Certified Ethical Hacker (CEH)

Start my 1-month free trial Buy for my team

Attacking session management mechanisms

“

- [Instructor] Now let's talk a little bit about session IDs, right? And an attacker can perform session-based attacks or session hijacking attacks if you can predict session IDs. Session IDs often are in the form of cookies and if you use things that are very predictable, so of course you know numbers like 1, 2, 3, and then you will expect there will be a 4 or before 1, 2, 3, there may be a 2 or a 1, and of course that's actually something that an attacker can leverage to compromise a system. Now another thing is weak pseudo random number generators, right? So basically modern frameworks, they support good pseudo random number generators, but in some cases of course we also implement them in a different way, or we take shortcuts that may actually introduce, you know, vulnerabilities and, of course, will introduce, you know, problems that an attacker can leverage. Now, cookies themself should be non-persistent. So the session IDs within cookies should not be persistent. That means…

Contents