41. Session Hijacking – Tokens, Cookies and Defence
41.1 What Is a Session – Why Hijacking Matters
HTTP = request/response, server does not remember you by default. After login, server creates a session and gives the browser a session ID (often in a cookie like PHPSESSID / JSESSIONID, sometimes a token). Next requests carry that ID → server looks up "this is Rani, role = owner".
Session hijacking = attacker uses a valid session ID that belongs to someone else, without knowing the password. Password safe rahila – pan identity compromise zali. Interview madhe clear bola: hijack ≠ always cracking the password hash.
Thodkyaat: session token = temporary gate pass. Stolen pass = thief walks in as staff. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Steals / guesses / fixes victim session ID | HttpOnly+Secure cookies; regenerate ID on login; short TTL |
| Replays cookie from another browser / IP | Concurrent-session alerts; bind soft signals (UA/IP) carefully |
| Targets apps that trust cookie alone forever | MFA for sensitive actions; logout server-side invalidate |
Ravindra Bagale's Tip
Students "HTTPS lavla = session safe forever" mhantat. HTTPS transit protect karto – pan XSS, fixation, weak logout, long-lived tokens still break you. Layered session hygiene. He lakshat theva.
Lab
Notes madhe 6-row table: session | session ID | cookie | token | hijacking | fixation – ek-ek line def + one Blue control. Fictional Sahyadri Traders (Nashik) staff portal – Amir login zala, Salman same cookie paste karun dashboard baghto. Kontya CIA property break? 5 sentences.