The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Obtain a session token as a completely anonymous user, and then walk

through the process of submitting sensitive data, up until any page at

which the sensitive data is displayed back.

■

If the same token originally obtained can now be used to retrieve the

sensitive data, then the application is vulnerable to session fixation.

■

If any type of session fixation is identified, verify whether the server

accepts arbitrary tokens it has not previously issued. If so, the vulnerabil-

ity is considerably easier to exploit over an extended period.

Preventing Session Fixation Vulnerabilities

At any point at which a user interacting with the application transitions from

being anonymous to being identified, the application should issue a fresh session

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 453

---