Ravi Sir's Cyber Security Cards › Interview Cards
What session attacks should a web defender know?
What session attacks should a web defender know? Session hijacking (via XSS or sniffing HTTP), fixation , and weak logout. On plain HTTP, an attacker on the same Wi-Fi can read the session cookie. “Fixes: HTTPS, cookie flags, regenerate the session id on login, short timeouts, server-side logout.” A
Read card text
What this card says
Short answer
Session hijacking (via XSS or sniffing HTTP), fixation, and weak logout.
Example
On plain HTTP, an attacker on the same Wi-Fi can read the session cookie.
Say it in the interview
“Fixes: HTTPS, cookie flags, regenerate the session id on login, short timeouts, server-side logout.”
Why it matters
A stolen session lets an attacker in as the user, with no password needed.
Learn more in the lesson: 46.9 AD, Malware, Session, IoT and Mobile — Defensive Talking Points