TechKnowSurge

VideoSecurityFree

Session Hijacking

Session hijacking occurs when an attacker takes over an active communication session between a client and a server, effectively impersonating the legitimate user. Cookies and tokens are among the primary mechanisms targeted in this type of attack.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Session hijacking is a cyberattack in which an adversary intercepts and takes over an active, authenticated session between a client and a server. When a user logs into a web application, a persistent session is created to maintain the connection, tracked through a combination of TCP-layer identifiers and application-layer mechanisms such as cookies and tokens. These session controls allow the server to recognize and authorize the client across multiple requests without requiring repeated authentication. An attacker who gains access to these identifiers can effectively step into that session, communicating with the server as if they were the original user. This type of attack is closely related to credential replay and pass-the-token attacks, all of which exploit session or authentication artifacts rather than stealing plaintext credentials. Once a session is hijacked, the attacker inherits whatever privileges the legitimate user held at the time, making it a particularly dangerous form of unauthorized access. The attack is sometimes called cookie hijacking when the targeted artifact is specifically a session cookie, though the underlying concept applies to any session token used to maintain authenticated state between a client and a server.

What you'll learn

Explain how session hijacking occurs by describing how an adversary intercepts and takes over an authenticated session between a client and a server
Identify common session tracking mechanisms, such as cookies and tokens, that are targeted in session hijacking attacks

What's covered

Session Hijacking

What It Is
- Adversary Takes Over Session
- Also Called Cookie Hijacking
- Related to Credential Replay
How Sessions Work
- Client Connects to Server
- Tracked via TCP Layer
- Tracked via Application Layer
Session Mechanisms
- Cookies
- Tokens
- Authentication Pieces
Attack Scenario
- Client Logs Into Application
- Adversary Intercepts Session
- Impersonates Legitimate Client

Key terms

Session Layer: Layer 5 of the OSI model, responsible for establishing, managing, and terminating communication sessions.
Authentication: The process of verifying the identity of a user, device, or system.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Transmission Control Protocol: A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Session Hijacking: An attack in which a threat actor takes over an authenticated session by stealing or forging the session token, gaining unauthorized access to resources without needing the user's credentials.
Cookie: A small data file stored on a user's device by a web browser to track session state, preferences, and user activity across visits to a website.
Token: A digitally generated credential used to authenticate and maintain a user's session with a server after initial login.

Topics

Session Hijacking Web Security Cookies Authentication Tokens Cybersecurity Attack Techniques

Transcript

Session hijacking

One thing that can happen with a credential replay attack or a pass the token attack is that there could be some sort of session hijacking.

Let's set up a little scenario here. Let's say we have a client machine that's connecting to a web server that's hosting an application. What you're going to do is you're going to log into this application, and it's going to then keep that connection open. So it's going to communicate back and forth through what we call a session.

These sessions between these two devices get established, and it's tracked through multiple ways: one from the TCP side, and it's also tracked on the application side. We have several mechanisms that could be shared back and forth between these to track this session and make sure it's live. An authentication piece could be a part of this as well.

Session hijacking is when an adversary takes over a session. So in this scenario right here, we have a laptop that logs into this application and they're logged in. Well, somewhere during the process, this adversary takes over the session and hijacks the session. Now they are the one that's communicating to the server as if they were this end client. So that's what session hijacking is.

Some of the mechanisms that control these sessions and the authorization of them would be cookies and tokens, and sometimes you can hear this be referred to as cookie hijacking as well.

So here's that attack card on session hijacking. It's when an adversary takes over a session. A session gets created between a client and a server, and then the adversary steps in and takes over that session and hijacks that session.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →