Web Security: Common Vulnerabilities And Their Mitigation - Session hijacking - count the ways

The video discusses session hijacking, a security threat where attackers steal session IDs to impersonate users. It explains various methods of session hijacking, including session fixation, side jacking, and cross-site scripting. The video also covers how session IDs are transmitted to clients via cookies, URL parameters, and hidden form fields, highlighting the security risks associated with each method. Cookies are considered the least insecure method, but still vulnerable. The video advises against passing session IDs in URLs due to security risks and recommends using POST requests for form submissions.

What is session hijacking primarily concerned with?

• Modifying website content

• Accessing a user's email account

• Impersonating a user by obtaining their session ID

• Stealing user passwords

Which method is considered the least insecure for sending session IDs?

• URL parameters

• Hidden form fields

• Cookies

• Email attachments

Why is it not recommended to pass session IDs in URLs?

• It complicates the user interface

• It increases server costs

• It can lead to session hijacking

• It makes the website load slower

What is a safer alternative to GET requests for form submissions?

• Using hidden form fields

• Using URL parameters

• Using POST requests

• Using cookies

What potential risk is associated with sharing a URL containing a session ID?

• The session ID might expire

• The URL might not work

• The session ID could be used to access sensitive information

• The URL could be too long