Session Hijacking
Session hijacking is an attack that involves taking over a user's active session by stealing the session token or cookie. The attacker gains access to the application as the victim, bypassing authentication. Session hijacking is particularly dangerous after MFA implementation.
What is Session Hijacking?
Session Hijacking Definition
Session hijacking is an attack in which an attacker steals or intercepts a user’s session token to gain unauthorized access to an application or system. After hijacking the session, the attacker acts as the logged-in user, completely bypassing the authentication process, including MFA.
Why Is Session Hijacking Dangerous?
- Bypasses MFA: Session token is already post-authentication
- Hard to detect: Looks like normal user activity
- Immediate access: No need to crack passwords
- Wide scope: Works on web applications, cloud, APIs
Session Hijacking Methods
Session Token Theft:
- Cookie theft via XSS
- Malware stealing tokens from browser
- Infostealers (Redline, Raccoon)
Man-in-the-Middle:
- Intercepting token on network
- SSL stripping
- Rogue Wi-Fi
Session Fixation:
- Attacker imposes known session token
- Victim logs in using that token
- Attacker hijacks session
Cross-Site Script Inclusion (XSSI):
- Session data leakage via JSONP
- Cross-origin issue exploitation
Session Hijacking After MFA
Modern attacks focus on token theft after MFA:
- Adversary-in-the-Middle (AiTM): Phishing proxy intercepts session token after MFA authentication
- Infostealer: Malware steals cookies from browser
- Token replay: Using stolen token from another location
Defense Against Session Hijacking
Application-level:
- HTTPOnly and Secure flags on cookies
- Token binding to IP/device fingerprint
- Short session timeouts
- Re-authentication for sensitive operations
Infrastructure:
- HTTPS everywhere
- HSTS
- CSP against XSS
Detection:
- Session anomaly monitoring
- Impossible travel detection
- Device fingerprint changes
Session Hijacking vs Credential Theft
| Aspect | Session Hijacking | Credential Theft |
|---|---|---|
| What’s stolen | Session token | Password/credentials |
| Bypasses MFA | Yes | No (without token) |
| Persistence | Until session expires | Until password change |
| Detectability | Harder | Easier |
Session hijacking is a growing threat in the era of widespread MFA, requiring advanced session protection mechanisms.