Web Security: Common Vulnerabilities And Their Mitigation - Session hijacking using session fixation

The video tutorial explains session fixation, a security vulnerability where attackers set a session ID for a user, allowing them to impersonate the user. It discusses how attackers exploit this vulnerability by sending links with fixated session IDs and highlights the importance of generating new session IDs upon login. The tutorial also covers the limitations of server-generated session IDs and the risks of cross sub-domain cookies, emphasizing the need for robust security practices to prevent session fixation attacks.

What is the primary goal of session fixation?

• To delete a user's session ID

• To steal a user's session ID

• To set a user's session ID to a known value

• To encrypt a user's session ID

How does untrustedbank.com become vulnerable to session fixation?

• By generating new session IDs for each login

• By accepting session IDs only from cookies

• By accepting any session ID specified by the user

• By using encrypted session IDs

What action does the attacker take to exploit the session fixation vulnerability in untrustedbank.com?

• Sends a phishing email with a fixated session ID link

• Hacks into the bank's server

• Steals the victim's password

• Uses a brute force attack

Why are server-generated session IDs not a complete solution to session fixation?

• Attackers can still use their own server-generated IDs

• They are always encrypted

• They require user consent

• They are too complex to implement

What is a cross sub-domain cookie?

• A cookie that is encrypted

• A cookie that cannot be accessed by sub-domains

• A cookie set by a sub-domain on the main domain

• A cookie set by the main domain

How can an attacker exploit cross sub-domain cookies?

• By using cookies only from the main domain

• By setting a cookie on a trusted site through an untrusted sub-domain

• By deleting all cookies from the browser

• By encrypting the cookies

What should a trusted site avoid to prevent session fixation via cross sub-domain cookies?

• Allowing third-party sub-domains to set cookies

• Using encrypted session IDs

• Generating new session IDs for each login

• Accepting session IDs only from query strings