full-disclosure - defense against session hijacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51528.204.128.72.220.1069161535.squirrel@browsermail.ziemba.net>
From: jason at ziemba.net (Jason Ziemba)
Subject: defense against session hijacking

I'm not going to claim that my method is fool-proof, but..
If you are using sessions on your site then you should have the ability to
track the movement of a user through-out your system.

If you record the last page the user was on (with a specific session-id)
and then check the referrer server variable on their next hit.  Compare
the referrer to their last known page.  Most of the time (depending on the
complexity of your site) the referrer and last known page should match. 
If their session is 'hijacked', odds are the 'hijacker' will not be
following in a valid user's footsteps, more likely they will just be
coming at the server with rogue data.  The referrer check won't match and
thus the validity of the session request is also void.

The catch is, how much programming are you willing to do to ensure the
integrity of your system.  If you are looking for the easy-route (using
PHP's embedded session module) then there is no direct way to secure the
sessions.  If you are willing to build you own session module for your
given CGI language then the sky is the limit (as long as you are willing
to get your hands dirty at the start).

Jason Ziemba

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi All,
>
> Sorry if this is common knowledge or regularly discussed; I'm fairly
> new to the list.  I see quite a few messages on this and other
> security lists about session hijacking in Web applications.  Isn't it
> good defense for a programmer to store the IP address of the client
> when the session is initiated, and then compare that address against
> the client for each subsequent request, destroying the session if the
> address changes?  Do many programmers really overlook this simple
> method to protect against such an attack?  It's not perfect but should
> significantly increase the difficulty of such an attack with little or
> no annoying side effects for the legitimate user.  Would it be useful
> to extend the session modules of the common Web scripting languages
> (e.g. PHP) to enable an IP address check by default?
>
> Best Regards,
>
> - --
> :: t  h  o  m  a  s       d  u  f  f  e  y
> :: h o m e b o y z   i n t e r a c t i v e
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQE/uTrH8fKWAp8CzDARAhyOAJ9kXkkiUERgEVRWhH5GtGACTKA1hwCfak+7
> KsyUSQG+iAcPVxX3BIdTTRc=
> =9f2R
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>