The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

196

Chapter 7 

■

Attacking Session Management

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 196

---

Some of these vulnerabilities will arise even if HTTPS is used throughout

the application.

The final case just described presents an attacker with a highly effective

means of capturing session tokens in some applications. For example, if a web

mail application transmits session tokens within the URL, then an attacker can

send emails to users of the application containing a link to a web server that he

controls. If any user accesses the link (e.g., because they click on it, or because

their browser loads images contained within HTML-formatted email), then

the attacker will receive, in real time, the session token of the user. The attacker

can run a simple script on his server to hijack the session of every token

received and perform some malicious action, such as send spam email, harvest

personal information, or change passwords.

N OT E