41. Session Hijacking – Tokens, Cookies and Defence
41.1 What Is a Session – Why Hijacking Matters
HTTP = request/response, server does not remember you by default. After login, server creates a session and gives the browser a session ID (often in a cookie like PHPSESSID / JSESSIONID, sometimes a token). Next requests carry that ID → server looks up "this is Rani, role = owner".
Session hijacking = attacker uses a valid session ID that belongs to someone else, without knowing the password. Password safe rahila – pan identity compromise zali. Interview madhe clear bola: hijack ≠ always cracking the password hash.
Thodkyaat: session token = temporary gate pass. Stolen pass = thief walks in as staff. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Steals / guesses / fixes victim session ID | HttpOnly+Secure cookies; regenerate ID on login; short TTL |
| Replays cookie from another browser / IP | Concurrent-session alerts; bind soft signals (UA/IP) carefully |
| Targets apps that trust cookie alone forever | MFA for sensitive actions; logout server-side invalidate |
Ravindra Bagale's Tip
Students say "we added HTTPS, so the session is safe forever". HTTPS protects data in transit – but XSS, fixation, weak logout and long-lived tokens can still break you. Use layered session hygiene. Remember this.
Ravindra Bagale's Tip – मराठी
Students "HTTPS लावला = session कायम safe" म्हणतात. HTTPS transit protect करतो – पण XSS, fixation, weak logout, long-lived tokens अजूनही तुम्हाला मोडू शकतात. Layered session hygiene. हे लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "HTTPS लगा दिया = session हमेशा safe". HTTPS transit protect करता है – पर XSS, fixation, weak logout, long-lived tokens फिर भी आपको तोड़ सकते हैं. Layered session hygiene. यह याद रखो.
Lab
Notes madhe 6-row table: session | session ID | cookie | token | hijacking | fixation – ek-ek line def + one Blue control. Fictional Sahyadri Traders (Nashik) staff portal – Amir login zala, Salman same cookie paste karun dashboard baghto. Kontya CIA property break? 5 sentences.