Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 257AttacksSession hijacking attacks include:● Cookie replay. The attacker captures the authentication cookie either by usingnetwork monitoring software or by some other means, for example, by exploitingan XSS scripting vulnerability.● Query string manipulation. A malicious user changes the session identifier that isclearly visible in the URL query string.CountermeasuresYou can employ the following countermeasures to prevent session hijacking:●●●●Separate personalization and authentication cookies.Only transmit authentication cookies over HTTPS connections.Do not pass session identifiers that represent authenticated users in query strings.Re-authenticate the user before critical operations, such as order placement,money transfers, and so on, are performed.Identity SpoofingIdentity spoofing occurs when a malicious user assumes the identity of a legitimateuser so that he can access the application.VulnerabilitiesCommon vulnerabilities that make your Web pages and controls susceptible to anidentity spoofing attack include:● Authentication credentials that are passed over unencrypted links● Authentication cookies that are passed over unencrypted links● Weak passwords and policies● Weak credential storage in the user storeAttacksIdentity spoofing attacks include:● Cookie replay. The attacker steals the authentication cookie either by usingnetwork monitoring software or by using an XSS attack. The attacker then sendsthe cookie to the application to gain spoofed access.●●Brute force password attacks. The attacker repeatedly tries username andpassword combinations.Dictionary attacks. In this automated form of a brute force password attack, everyword in a dictionary is tried as a password.