the-web-application-hackers-handbook

Chapter 7 n Attacking Session Management 243
c. If the page is displayed as normal, the token is still active.
d. Use trial and error to determine how long any session expiration timeout
is, or whether a token can still be used days after the last request
using it. Burp Intruder can be configured to increment the time interval
between successive requests to automate this task.
2. Determine whether a logout function exists and is prominently made
available to users. If not, users are more vulnerable, because they have no
way to cause the application to invalidate their session.
3. Where a logout function is provided, test its effectiveness. After logging out,
attempt to reuse the old token and determine whether it is still valid. If so,
users remain vulnerable to some session hijacking attacks even after they
have “logged out.” You can use Burp Suite to test this, by selecting a recent
session-dependent request from the proxy history and sending it to Burp
Repeater to reissue after you have logged out from the application.
TRY IT!
http://mdsec.net/auth/423/
http://mdsec.net/auth/439/
http://mdsec.net/auth/447/
http://mdsec.net/auth/452/
http://mdsec.net/auth/457/
Client Exposure to Token Hijacking
An attacker can target other users of the application in an attempt to capture
or misuse the victim’s session token in various ways:
n An obvious payload for cross-site scripting attacks is to query the user’s
cookies to obtain her session token, which can then be transmitted to an
arbitrary server controlled by the attacker. All the various permutations
of this attack are described in detail in Chapter 12.
n Various other attacks against users can be used to hijack the user’s session
in different ways. With session fixation vulnerabilities, an attacker feeds
a known session token to a user, waits for her to log in, and then hijacks
her session. With cross-site request forgery attacks, an attacker makes
a crafted request to an application from a web site he controls, and he
exploits the fact that the user’s browser automatically submits her current
cookie with this request. These attacks are also described in Chapter 12.