Ravindra BagaleCourses & study guides

41. Session Hijacking – Tokens, Cookies and Defence

41.1 What Is a Session – Why Hijacking Matters

HTTP = request/response, server does not remember you by default. After login, server creates a session and gives the browser a session ID (often in a cookie like PHPSESSID / JSESSIONID, sometimes a token). Next requests carry that ID → server looks up "this is Rani, role = owner".

Session hijacking = attacker uses a valid session ID that belongs to someone else, without knowing the password. Password safe rahila – pan identity compromise zali. Interview madhe clear bola: hijack ≠ always cracking the password hash.

Thodkyaat: session token = temporary gate pass. Stolen pass = thief walks in as staff. Samjla ka?

Red team (attacker) does Blue team (defender) detects / stops
Steals / guesses / fixes victim session ID HttpOnly+Secure cookies; regenerate ID on login; short TTL
Replays cookie from another browser / IP Concurrent-session alerts; bind soft signals (UA/IP) carefully
Targets apps that trust cookie alone forever MFA for sensitive actions; logout server-side invalidate

Ravindra Bagale's Tip

Students say "we added HTTPS, so the session is safe forever". HTTPS protects data in transit – but XSS, fixation, weak logout and long-lived tokens can still break you. Use layered session hygiene. Remember this.

Lab

Notes madhe 6-row table: session | session ID | cookie | token | hijacking | fixation – ek-ek line def + one Blue control. Fictional Sahyadri Traders (Nashik) staff portal – Amir login zala, Salman same cookie paste karun dashboard baghto. Kontya CIA property break? 5 sentences.