S02E19

What Is Session Hijacking?

Session hijacking occurs when an attacker steals, predicts, intercepts, or reuses the token that an application relies on to recognize an authenticated user. Certification exams may test why possession of a session cookie or bearer token can allow access without entering the victim’s password or completing multifactor authentication again. Attackers may obtain session information through malware, insecure connections, cross-site scripting, exposed logs, or compromised browsers. Defenses include encrypted communications, secure cookie attributes, short session lifetimes, token rotation, reauthentication for sensitive actions, browser protections, and immediate session revocation after suspicious activity. During an investigation, defenders should terminate active sessions, reset credentials when appropriate, review changes made during the compromised period, and determine how the session information was exposed. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!