Understanding Session Hijacking

Session hijacking is synonymous with a stolen session, in which an attacker intercepts and takes over a legitimately established session between a user and a host. The user-host relationship can apply to access of any authenticated resource, such as a web server, Telnet session, or other TCP-based connection. Attackers place themselves between the user and host, thereby letting them monitor user traffic and launch specific attacks. Once a successful session hijack has occurred, the attacker can either assume the role of the legitimate user or simply monitor the traffic for opportune times to inject or collect specific packets to create the desired effect. Figure 12.1 illustrates a basic session hijack.

In its most basic sense, a session is an agreed-upon period of time under which the connected state of the client and server are vetted and authenticated. This simply means that both the server and the client know (or think they know) who each other are, and based on this knowledge, they can trust that data sent either way will end up in the hands of the appropriate party.

If a session hijack is carried out successfully, what is the danger? Several events can take place at this point, including identity theft and data corruption. In other situations session hijacks have made for a perfect mechanism through which someone can sniff traffic or record transactions.

Understanding what constitutes a session makes it easy to see how session hijacking can be extremely effective when all supporting factors are set up correctly. Many of the prerequisite setup factors involved in session hijacking have already been discussed in previous chapters. For example, a specific form of hijacking involves using a sniffer both prior to and during an attack, and you learned about sniffers in Chapter 9. In Chapter 2, “System Fundamentals,” you learned about the TCP three-way-handshake, which will greatly aid your understanding of TCP session hijacking. Before we get too deep into the details of each attack, let’s look at how session hijacking is categorized.

An attacker carrying out a session hijack is seeking to take over a session for their own needs. Once they have taken over a session they can then go about stealing data, issuing commands, or even committing transactions that they wouldn’t be able to otherwise. In this chapter, we will explore the various forms session hijacking can take and identify the methods you can use to thwart a session hijack.

Session hijacks are easy to launch. TCP/IP is vulnerable, and most countermeasures, except for encryption, do not work. The following also contribute to the success of session hijacking:

• No account lockout for invalid session IDs
• Insecure handling
• Weak session ID generation algorithm
• Indefinite session expiration time
• Cleartext transmission
• Small session IDs

Session hijacking typically can be broken down into one of three primary techniques:

Brute-Forcing an ID This is done by guessing an ID; usually the attacker already has some knowledge of the range of IDs available. The attacker may be aided by the use of HTTP referrers, sniffing, cross-site scripting, or malware.

Stealing an ID If they can manage it, an attacker will steal an ID by using sniffing or other means.

Calculating an ID An attacker will attempt to calculate a valid session ID simply by looking at an existing one and then figuring out the sequence.

Active and Passive Attacks

You can categorize a session hijacking attack as either an active attack or a passive attack. Let’s look at both.

Active Attack A session hijacking attack is considered active when the attacker assumes the session as their own, thereby taking over the legitimate client’s connection to the resource. In an active attack the attacker is actively manipulating and/or severing the client connection and fooling the server into thinking they are the authenticated user. Additionally, active attacks usually involve a DoS result on the legitimate client. In other words, they get bumped off and replaced by the attacker. Figure 12.2 shows what this kind of attack looks like.

Passive Attack A passive attack focuses on monitoring the traffic between the victim and the server. This form of hijacking uses a sniffer utility to capture and monitor the traffic as it goes across the wire. (Refer to Chapter 9 for a more in-depth description of sniffer use.) A passive attack doesn’t “molest” the session in any way. Unlike an active attack, the passive attack sets the stage for future malicious activity. An attacker has a strategically advantageous position when in a passive session hijack; they can successfully capture and analyze all victim traffic, and progress to an active attack position with relative ease. Figure 12.3 shows a passive attack.

www.ceh.net/app/spo22022005131020
www.ceh.net/app/spo22022005141520
www.ceh.net/app/spo22022005171126
www.ceh.net/app/spo22022005213111

A Few Key Concepts

Here are a few concepts that come up in many session hijacking topic discussions:

Blind Hijacking Blind hijacking describes a type of session hijack in which the attacker cannot capture return traffic from the host connection. What this means is that the attacker is “blindly” injecting malicious or manipulative packets without seeing confirmation of the desired effect through packet capture. The attacker must attempt to predict the sequence numbers of the TCP packets traversing the connection. The reason for this prediction goes back to the basic TCP three-way handshake. We’ll dig more into this later in the section “Network Session Hijacking.”

IP Spoofing IP spoofing refers to an attacker’s attempt at masquerading as the legitimate user by spoofing the victim’s IP address. The concept of spoofing can apply to a variety of attacks in which an attacker spoofs a user’s identifying information. Let’s draw a line in the sand here, and definitively agree that spoofing is a different approach and attack from session hijacking; however, they are related in that both approaches aim at using an existing authenticated session to gain access to an otherwise inaccessible system. Figure 12.4 shows the spoofing approach.

Source Routing In contrast to normal packet routing, source routing (Figure 12.5) ensures that injected packets are sent via a selected routing path. By using source routing, an attacker chooses the routing path that is most advantageous to the intended attack. For example, an attacker attempting to spoof or masquerade as a legitimate host can use source routing to direct packets to the server in a path identical to the victim’s machine.

DNS Spoofing DNS spoofing is a technique in which an attacker alters a victim’s IP address mappings in an effort to direct the victim machine’s traffic to an address the attacker specifies. This is a fairly simplified explanation, but the concept and intent are the same in all variations of this technique. Later in the section “Network Session Hijacking,” you’ll see how DNS spoofing also applies to hijacking vulnerable web applications.

ARP Cache Poisoning ARP cache poisoning was covered in Chapter 9, but here’s a brief review. ARP is responsible for translating MAC addresses to IP addresses, or vice versa (known as reverse ARP, or RARP). An ARP cache poisoning attack overwrites a victim’s ARP cache, thereby redirecting traffic to an inaccurate physical address mapping, usually the attacker’s machine. This in turn puts the attacker’s machine in the logical middle of all communications between the victim’s machine and the authenticated host. ARP cache poisoning, as you’ve probably already deduced, is conceptually very similar to DNS spoofing. The goal is to manipulate the traffic flow based on directional data stored in the host.

Desynchronizing the Connection Referring once again to our TCP three-way handshake, when a client and a host are initializing a connection, they exchange packets that set the sequence for further data transfer. Each packet in this continuous transfer has a sequence number and subsequent acknowledgment numbers. TCP connections begin their sequencing of packets with what is known as an initial sequence number (ISN). The ISN is basically a starting point on which all following packets can increment and sequence themselves accordingly. Desynchronizing a connection (Figure 12.6) involves breaking the linear sequence between the victim and the host, thereby giving the attacker the opportunity, at least sequence-wise, to jump in and take over the connection to the host. For example, suppose an attacker setting up a session hijacking attack has been tracking the sequence of the connection and is ready to launch an attack. To make the job easier, and at the same time remove the victim from the picture, the attacker can inject a large volume of null packets directed at the host machine. This in turn increments the sequence numbers of the host packets without the acknowledgment or purview of the victim machine. Now the attacker has successfully desynchronized the connection and has staged the host packet sequence numbers to a predictable count based on the number of null packets sent.

Network Session Hijacking

Network-level session hijacking is a hijacking method that focuses on exploiting a TCP/IP connection after initialization or authentication has occurred. There are some specific hijacking techniques that are in this category of attack. Some common ones we will discuss are TCP/IP hijacking, man-in-the-middle attacks, and UDP session hijacking.

TCP/IP Session Hijacking

TCP/IP session hijacking is an attack on a TCP session. The attacker attempts to predict the sequence numbers of the packets flowing from the victim’s machine to the connected resource. If successful, the attacker can then begin to inject packets that are “in sequence” with the packet sequence of the legitimate user’s traffic.

As shown in Figure 12.7, once the initial handshake process is complete, the subsequent packets stay in a general sequence between the victim and the resource. Each packet in an ongoing conversation over TCP is incremented by 1. This rule applies to both SYN and ACK sequence numbers.

Implementation of this kind of attack first begins with the attacker sniffing the traffic between the victim’s machine and the host machine. Once the attacker successfully sniffs the connection and predicts (to the best of their ability) the packet sequence numbers, they can inject custom packets onto the wire that have a spoofed IP of the victim machine as well as a sequence number incremented appropriately based on previously captured packets. An attacker spoofs the IP address of the victim’s machine to try to assume the identity of the victim by hijacking the connection and the current session. From the server’s or host’s perspective, packets coming from a legitimate IP address, as well as having a properly incremented sequence number, are deemed legitimate traffic. Figure 12.7 outlines what this would look like.

Before we move on, let’s go through the basic steps of a TCP session hijack attack. You don’t have to memorize these steps for the exam, but understanding their sequence and what each step accomplishes will help you apply common sense to the challenging scenarios you’ll face. We’ve already covered a few of these, so we’re ahead of the game! Just pay attention to the sequence and relate it to what you’ve already learned.

1. Referring back to Chapter 9 once more, you must have a means of sniffing or capturing the traffic between the victim machines. This places you in the position required to perform the hijack.
2. Predict the sequence numbers of the packets traversing the network. Remember that null packets can be used to increment the host sequence numbers, thereby desynchronizing the victim’s connection and making sequence number prediction easier.
3. Perform a denial-of-service attack on the victim’s machine, or reset their connection in some fashion so you can assume the victim’s role as the legitimate client. Remember that in a passive hijacking, the victim connection is not necessarily severed; the traffic between the victim and the host is simply monitored, and you wait for the opportune time to act.
4. Once you take over the victim’s session, you can start injecting packets into the server, imitating the authenticated client.

Let’s go back to blind hijacking for a moment. As we discussed earlier, in blind hijacking the attacker is not able to see the result of the injected packets, nor are they able to sniff the packets successfully. This creates a major challenge for the attacker because sequencing packets properly is a critical step in launching a successful TCP-based session hijacking. Referring back to Chapter 9, recall that there is a logistical challenge in sniffing traffic from other networks or collision domains. This is because each switchport is an isolated collision domain. An attacker attempting to perform a session hijack attack on a victim machine outside the attacker’s network or network segment creates a challenge similar to the one you faced in sniffing traffic in Chapter 9. The attacker will be going in “blind” because they will not be able to receive a return traffic confirmation of success.

Man-in-the-Middle

Man-in-the-middle (MITM) attacks take the cake as one of the best-known versions of a session hijack attack. Essentially, an MITM attack places attackers directly between a victim and host connection. Once attackers have successfully placed themselves in the middle of the connection via a technique such as ARP poisoning, they have free rein to passively monitor traffic, or they can inject malicious packets into either the victim or the host machine. Let’s continue with ARP poisoning for our example. The attacker will first sniff the traffic between the victim and host machine, which places them in a passive yet strategic position. From here, the attacker can send the victim phony or “poisoned” ARP replies that map the victim’s traffic to the attacker’s machine; in turn, the attacker can then forward the victim’s traffic to the host machine. While in this forwarding position, the attacker can manipulate and re-send the victim’s sent packets at will. Take a look at Figure 12.8, and then proceed to Exercise 12.1, which shows a basic MITM attack in action.

UDP Session Hijacking

UDP session hijacking is conceptually simpler than its TCP brethren because UDP doesn’t use sequencing for its packets. As you’ll recall, UDP is a connectionless protocol, meaning it doesn’t establish a verifiable connection between the client and the host. For an attacker, this means no packet sequence is needed. The aim of a UDP hijack is to fool the victim into thinking the attacker’s machine is the server. The attacker must try to get a response packet back to the client before the legitimate host, thereby assuming the role of the server. Different techniques can be used to intercept legitimate server traffic prior to its response to the victim, but the basic goal is the same.

Exploring Defensive Strategies

Session hijacking relies, in part, on many of the prerequisites needed to successfully sniff a network. For instance, session hijacking attacks increase in complexity for external and switched networks. In other words, sitting on the local LAN (for example, as a disgruntled employee) is a much better strategic position for an attack than sitting outside the gateway. Aside from its relationship with sniffing, let’s take a look at methods you can use to help prevent session hijacking:

• Encrypting network traffic is a viable and effective preventive technique against hijacking attacks, both from internal and external sources. As you’ll recall from previous chapters, encryption hampers your legitimate efforts to monitoring your own network traffic.
• Using network-monitoring appliances such as an IPS or IDS can help in detecting and preventing network anomalies such as ARP broadcast traffic. These anomalies can be indicators of potential session hijacking attacks in progress.
• Configure the appropriate appliances, such as gateways, to check and filter for spoofed client information such as IP addresses.
• Be aware of local browser vulnerabilities such as extended history logs and cookies. Clearing temporary browsing information can help in preventing the use of old session IDs.
• Stronger authentication systems such as Kerberos will provide protection against hijacking.
• The use of technologies such as IPSec and SSL will also provide protection against hijacking.
• Defense-in-depth, or the use of multiple defensive technologies to slow or deter an attacker, provides protection as well.

Pen testing to discover vulnerability to session hijacking depends on the defensive strategies of the client. Encryption should be implemented for sensitive network traffic to resources such as servers. Additionally, implementing policies that limit the generation of unique session tokens to intranet resources can reduce the probability of an attacker’s stealing an active session. Putting protective network appliances such as IPSs and IDSs to the test exposes critical weaknesses in identifying and preventing successful session hijacking attempts.

Summary

In this chapter we focused on session hijacking and what constitutes an attack. You learned the difference between active and passive hijacking and looked at network-level and application-level attacks. We discussed TCP session hijacking and emphasized the importance of understanding packet sequencing for the exam. We also looked at different sources of session IDs and touched on web application hijacking. We also explored man-in-the-middle attacks and walked through the basic setup.

Exam Essentials

Know what makes up a session hijacking. Make sure you can pick up on a session hijack attack easily. The exam is fairly straightforward on session hijacking questions. Most of the time the image will give it away, or it will become obvious in the question discussion that a session hijacking has either occurred or is about to.

Know your TCP sequencing. Knowing the sequencing of TCP packets is important for you as an ethical hacker and is extremely important for the exam. Understand the TCP three-way handshake as well.

Remember the difference between an active attack and a passive attack. An active attack is one in which the attacker is injecting packets or manipulating the connection in some fashion. In a passive attack, the attacker only monitors the traffic between client and host machines.

Know the steps of a session hijack. Familiarize yourself with the steps of a TCP session hijacking attack.

Be able to define ARP poisoning and DNS spoofing. Understand both concepts, and keep a lookout for scenario-driven questions that begin with ARP poisoning or DNS spoofing as supporting factors for the attack. This is a signal that the question is talking about a session hijacking attack.

Understand web application hijacking. Remember the three sources of session IDs: embedded in a URL, hidden in an embedded form, or in a session cookie. Your focus is not necessarily in knowing all the nuances of each source, but to recognize what the exam question is asking you to recognize. The exam will usually give you ample evidence and explanatory material in each question, so your job as the test taker is to sleuth out exactly what is important and pertinent to answer the question.

Recognize flexibility in terminology. Session hijacking is a category of attack in which the exam presents the topic in many varied ways. A web app session hijacking may be called something like session fixation. Or the possible answers to a diagram-based question may sound unfamiliar, but one or two of them have session in the answer. Stay focused on the big picture, and use common sense. If it looks like a session hijacking question, and sounds like a session hijacking question, well, it’s a session hijacking question! Answer accordingly.

Review Questions

1. Which statement defines session hijacking most accurately?

   1. Session hijacking involves stealing a user’s login information and using that information to pose as the user later.
   2. Session hijacking involves assuming the role of a user through the compromise of physical tokens such as common access cards.
   3. Session hijacking is an attack that aims at stealing a legitimate session and posing as that user while communicating with the web resource or host machine.
   4. Session hijacking involves only web applications and is specific to stealing session IDs from compromised cookies.

2. Julie has been sniffing the Wi-Fi traffic at a local coffee shop in an effort to learn more about sniffing tools and reading packet captures. She is careful not to inject packets, or to perform malicious activities; she just received her CEH credential, so she wants to stay white hat. What would Julie’s activities be categorized as?

   1. Passive
   2. Monitoring
   3. Active
   4. Sniffing

3. Based on the diagram, what attack is occurring?

   

   1. Session splicing
   2. Denial-of-service
   3. Source routing
   4. MITM

4. Jason is a junior system administrator for a small firm of 50 employees. For the last week a few users have been complaining of losing connectivity intermittently with no suspect behavior on their part such as large downloads or intensive processes. Jason runs Wireshark on Monday morning to investigate. He sees a large amount of ARP broadcasts being sent at a fairly constant rate. What is Jason most likely seeing?

   1. ARP poisoning
   2. ARP caching
   3. ARP spoofing
   4. DNS spoofing

5. Which of the following is not a source of session IDs?

   1. URL
   2. Cookie
   3. Anonymous login
   4. Hidden login

6. Which kind of values are injected into a connection to the host machine in an effort to increment the sequence number in a predictable fashion?

   1. Counted
   2. Bit
   3. Null
   4. IP

7. An ethical hacker sends a packet with a deliberate and specific path to its destination. What technique is the hacker using?

   1. IP spoofing
   2. Source routing
   3. ARP poisoning
   4. Host routing

8. Network-level hijacking focuses on the mechanics of a connection such as the manipulation of packet sequencing. What is the main focus of web app session hijacking?

   1. Breaking user logins
   2. Stealing session IDs
   3. Traffic redirection
   4. Resource DoS

9. A public use workstation contains the browsing history of multiple users who logged in during the last 7 days. While digging through the history, a user runs across the following web address: www.snaz22enu.com/&w25/session=22525. What kind of embedding are we seeing?

   1. URL embedding
   2. Session embedding
   3. Hidden form embedding
   4. Tracking cookie

10. Julie has sniffed an ample amount of traffic between the targeted victim and an authenticated resource. She has been able to correctly guess the packet sequence numbers and inject packets, but she is unable to receive any of the responses. What does this scenario define?

    1. Switched network
    2. SSL encryption
    3. TCP hijacking
    4. Blind hijacking

11. Session hijacking can be performed on all of the following protocols except which one?

    1. FTP
    2. SMTP
    3. HTTP
    4. SSL

12. Which technology can provide protection against session hijacking?

    1. IPSec
    2. UDP
    3. TCP
    4. IDS

13. Session fixation is a vulnerability in which of the following?

    1. Web applications
    2. Networks
    3. Software applications
    4. Protocols

14. Session hijacking can be thwarted with which of the following?

    1. SSH
    2. FTP
    3. Authentication
    4. Sniffing

15. XSS is typically targeted toward which of the following?

    1. Web applications
    2. E-mail clients
    3. Web browsers
    4. Users

16. A man-in-the-browser attack is typically enabled by using which mechanism?

    1. Virus
    2. Worms
    3. Logic bombs
    4. Trojans

17. A man-in-the-middle attack is an attack where the attacking party does which of the following?

    1. Infects the client system
    2. Infects the server system
    3. Insert themselves into an active session
    4. Insert themselves into a web application

18. A session hijack can happen with which of the following?

    1. Networks and applications
    2. Networks and physical devices
    3. Browsers and applications
    4. Cookies and devices

19. A session hijack can be initiated from all of the following except which one?

    1. E-mails
    2. Browsers
    3. Web applications
    4. Cookies and devices

20. Session hijacking can do all of the following except which one?

    1. Take over an authenticated session
    2. Be used to steal cookies
    3. Take over a session
    4. Place a cookie on a server