In this recipe, we followed the complete path of an attack involving social engineering, by sending an email containing a malicious link to a victim. This link exploited a session fixation vulnerability, which should have been previously discovered by the attacker, and when the victim user logs in to the application, it keeps the session ID provided by the attacker and links it to the user; this enables the attacker to manipulate his/her own parameters in the application to replicate the same ID, and thereby hijack a valid user's session.