The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 7 

■

Attacking Session Management

177

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 177

---

We will look at each of these areas in turn, describing the different types of

defects that are commonly found in real-world session management mecha-

nisms, and practical techniques for discovering and exploiting these. Finally,

we will describe measures that applications can take to defend themselves

against these attacks.

HACK STEPS

In many applications that use the standard cookie mechanism for transmitting

session tokens, it is straightforward to identify which item of data contains the

token. However, in other cases it may require some detective work.

■

The application may often employ several different items of data collec-