This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
Description
Attack Execution Flow
3
1
Step 1
ExploreThe attacker interacts with the target host and finds that session IDs are used to authenticate users.
AI Translation
L'attacker interagisce con l'host di destinazione e scopre che gli ID di sessione vengono utilizzati per autenticare gli utenti.
2
Step 2
ExploreThe attacker steals a session ID from a valid user.
AI Translation
L'attaccante ruba un ID di sessione da un utente valido.
3
Step 3
ExploitThe attacker tries to use the stolen session ID to gain access to the system with the privileges of the session ID's original owner.
AI Translation
L'attaccante tenta di utilizzare l'ID di sessione rubato per accedere al sistema con i privilegi del proprietario originale dell'ID di sessione.
Mitigations
6
Always Invalidate A Session Id After The User Logout.
Protect The Communication Between The Client And Server. For Instance It Is Best Practice To Use Ssl To Mitigate Adversary In The Middle Attacks (Capec-94).
Encrypt The Session Data Associated With The Session Id.
Setup A Session Time Out For The Session Ids.
Do Not Code Send Session Id With Get Method, Otherwise The Session Id Will Be Copied To The Url. In General Avoid Writing Session Ids In The Urls. Urls Can Get Logged In Log Files, Which Are Vulnerable To An Attacker.
Use Multifactor Authentication.
Consequences
Security Scopes Affected
Access Control
Authorization
Confidentiality
Potential Impacts
Gain Privileges
Relationships
Parent CAPECs
Related ATT&CK Techniques
2
T1134.001
Token Impersonation/Theft
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary …
T1550.004
Web Session Cookie
Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols …