The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

detects when the application has performed a forced logout, automatically logs

back in to the application, and returns the new session and page to the

browser, optionally with a pop-up message to inform you of what has occurred.

While this by no means removes the problem altogether, in certain cases it can

mitigate it substantially.

Chapter Summary

The session management mechanism provides a rich source of potential vul-

nerabilities for you to target when formulating your attack against an applica-

tion. Because of its fundamental role in enabling the application to identify the

same user across multiple requests, a broken session management function

usually provides the keys to the kingdom. Jumping into other users’ sessions

is good; hijacking an administrator’s session is even better, and will typically

enable you to compromise the entire application.

You can expect to encounter a wide range of defects in real-world session

management functionality. When bespoke mechanisms are employed, the

possible weaknesses and avenues of attack may appear to be endless. The