CAPEC-593: Session Hijacking
Description
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
- Likelihood of attack
- High
- Typical severity
- Very High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- An application that leverages sessions to perform authentication.
Skills required
- LowExploiting a poorly protected identity token is a well understood attack with many helpful resources available.
Consequences
- ConfidentialityIntegrityAvailability
Gain Privileges
A successful attack can enable an adversary to gain unauthorized access to an application.
Mitigations
- Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 3 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-APCAApplication Protocol Command Analysis3 shared
- D3-CSPPClient-server Payload Profiling3 shared
- D3-NTCDNetwork Traffic Community Deviation3 shared
- D3-NTFNetwork Traffic Filtering3 shared
- D3-NTSANetwork Traffic Signature Analysis3 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis3 shared
- D3-PMADProtocol Metadata Anomaly Detection3 shared
- D3-RTSDRemote Terminal Session Detection3 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis3 shared
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-STSession Termination1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.