the-web-application-hackers-handbook

540 Chapter 13 n Attacking Users: Other Techniques
HACK STEPS
1. Obtain a valid token by whatever means the application enables you to
obtain one.
2. Access the login form, and perform a login using this token.
3. If the login is successful and the application does not issue a new token,
it is vulnerable to session fixation.
If the application does not support authentication but does allow users to submit
and then review sensitive information, you should verify whether the same session
token is used before and after the initial submission of user-specific information. If
it is, an attacker can obtain a token and feed it to a target user. When the user submits
sensitive details, the attacker can use the token to view the user’s information.
HACK STEPS
1. Obtain a session token as a completely anonymous user, and then walk
through the process of submitting sensitive data, up until any page at
which the sensitive data is displayed back.
2. If the same token originally obtained can now be used to retrieve the sensitive
data, the application is vulnerable to session fixation.
3. If any type of session fixation is identified, verify whether the server
accepts arbitrary tokens it has not previously issued. If it does, the vulnerability
is considerably easier to exploit over an extended period.
Preventing Session Fixation Vulnerabilities
At any point when a user interacting with the application transitions from being
anonymous to being identified, the application should issue a fresh session token.
This applies both to a successful login and to cases in which an anonymous
user first submits personal or other sensitive information.
As a defense-in-depth measure to further protect against session fixation
attacks, many security-critical applications employ per-page tokens to supplement
the main session token. This technique can frustrate most kinds of session
hijacking attacks. See Chapter 7 for further details.
The application should not accept arbitrary session tokens that it does not
recognize as having issued itself. The token should be immediately canceled
within the browser, and the user should be returned to the application’s start page.
Open Redirection Vulnerabilities
Open redirection vulnerabilities arise when an application takes user-controllable
input and uses it to perform a redirection, instructing the user’s browser to