The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Session Fixation

Session fixation vulnerabilities typically arise when an application creates an

anonymous session for each user when they first access the application. If the

application contains a login function, this anonymous session will be created

prior to login and then upgraded to an authenticated one after they have

logged in. The same token that initially confers no special access later allows

privileged access within the security context of the authenticated user.

In a standard session hijacking attack, the attacker must use some means to

capture the session token of an application user. In a session fixation attack, on

the other hand, the attacker first obtains an anonymous token directly from the