the-web-application-hackers-handbook

238 Chapter 7 n Attacking Session Management
When applications transmit their session tokens in this way, it is likely that
their session tokens will appear in various system logs to which unauthorized
parties may have access:
n Users’ browser logs
n Web server logs
n Logs of corporate or ISP proxy servers
n Logs of any reverse proxies employed within the application’s hosting
environment
n The Referer logs of any servers that application users visit by following
off-site links, as shown in Figure 7-11
Some of these vulnerabilities arise even if HTTPS is used throughout the
application.
Figure 7-11: When session tokens appear in URLs, these are transmitted in the
Referer header when users follow an off-site link or their browser loads an offsite
resource.
The final case just described presents an attacker with a highly effective
means of capturing session tokens in some applications. For example, if a
web mail application transmits session tokens within the URL, an attacker
can send e-mails to users of the application containing a link to a web server
he controls. If any user accesses the link (because she clicks it, or because
her browser loads images contained within HTML-formatted e-mail), the
attacker receives, in real time, the user’s session token. The attacker can run
a simple script on his server to hijack the session of every token received and