Hello everyone and welcome back.
And in this video I will show you a certain type of the attack which is called session fixation which
is basically used when the owner of the website mis configured the website creation or basically anyone
who created that Web site it allowed a net user becomes the that some of the information that user sends
to the server becomes the I.D. of that session.
Now before we get into that I just want to show you another attack which is mostly which most likely
you will not come across especially not on some of the bigger web sites you might come across on it
for some of these smaller Web sites since it is basically a flaw in the cookie itself.
In the session itself.
If such an I.D. is not random enough sometimes you can basically guess the session I.D. of some of the
other user could just find a valid session I.D..
So in order to show you what I am talking about just open up your suit and on your little machine uh
which is the OS.
Just go here on the always web code.
If it asks you to log in just type your web code web code.
And after that you want to go on to the session management flaws right here and here you want to go
onto the hijack a session now as we can see right here.
We are prompted in with the username and password.
Now what we want to do is basically turn our intercept on and type here anything and send our post request.
And as we can see it is right here.
And what I'm talking about is this week I.D. Now it is called weak I.D. since data since it is purposely
made weak for this attack and for the first time ever you looking in it.
This might seem like a really random number but it isn't.
It is actually really easy to guess it.
I will just show you how you can generate a lot of cookie requests or different requests in order to
see for example 10000 different cookies.
And in order to compare them and see which values change in this session I.D. and which values don't
And three do that you can basically try to guess the session I.D. with it but we won't be going through
the entire text since it could take some time I'll just show you how you can check out the if the idea
of that session is weak or not so once we do that we want to turn on our intercept of the invalid username
and password of course.
Now we've got to go to the target find the page that we send the user in a password to.
So I'm not really sure where that is not even sure what type tactics username and password.
So let me just find it right here it's not this which pages it.
This is screens 72 menu 1 8.
OK.
So we want to find the web code.
Here it is something with web wrote this just find package right here so we search for the bad code
path.
Here it is.
You just see it snuck this one.
It's not.
It's one stone.
This one it's not this one.
Sure it is.
It's this one as we can see our ears and ESF Gs.
So what we want to do from here is you want to right click on the packet and send it to sequencer.
So once you go to the sequencer it will light up this part right here.
So just click on the sequencer and you will see that it already set the form a field to be weak idea
right here.
So what you want to do it gives you a bunch of other options.
Twenty seconds your session I.D. And once you do that
and click on the start to capture it will basically gather a lot of cookie values and it see the value
cookies is random enough or it or if it can be predicted.
So let's go and start to capture and as we can see right here it would start sending a bunch of packets
and gathering different cookie values.
And once and Katter's enough it can tell us if the cookie value is random enough for it to be well protected
if it is not random enough we will be able to cast another valid cookie value which can basically make
you enter someone else's session.
So for example if I sent the wrong user name and password and I scanned the cookie and sent a bunch
of other requests and scanned the other cookies and find out that the randomness of the numbers is not
high I can guess someone else's cookie session and basically enter their for example profile on on Facebook
for example without even knowing the user name or password but this is the attack that you most likely
will never ever encounter since it really must be mis configured website in order for this to be possible.
Today's websites have cookie values that you cannot possibly predict since they are really really random
and once this finishes or we do not even need to wait for it to finish I think we can click here analyze.
Now you can see that the overall result the overall quality of randomness within the sample is estimated
to be extremely poor so as we can see it says that the randomness of the cookie is extremely poor.
Significance level Figo for example to the count you can see some of the characters sets which basically
just show you how many characters appear and where the but just find right here if there is anything
interesting for us basically this uh the entropy is the value of the randomness.
And if you want to you can check out other options and outputs as well.
But I just want to show you this that you can scan for the weakness of the website I.D. with this method.
We won't be pursuing the attacks since there is no point as I said this is the attack that you most
likely will never encounter.
So let me just close this and let us go on to the attack that they want to show you which was the session
fixation attack.
Now this session fixation attack is done through link.
And now I will show you how to do it.
So it is under the same a subsection which is the session management force and just click here on the
session fixation.
Now it will say right here you are a hacker Joe and you want to steal the session from jail.
Send a prepared email to the victim which looks like an official e-mail from the bank.
So basically as you can see we have an example of the e-mail.
And here we want to send something within a link that will make us be able to hack another account without
knowing the user name or password.
Now we know that this page right here is vulnerable to the session I.D. being imported into the link
itself.
Sending it to someone.
And if someone clicks on that link it will have already premade session I.D. that you typed into the
link.
And once you know that session I.D. you can basically log in or basically just enter their account without
using username or password.
So let me show you how that is done.
If we go right here and if we look at the contents of the e-mail we can see that there is a link referring
to the Web to quote attack screen 56 menu one or eighteen hundred what you want to do is basically you
want to add this sign after the eighteen hundred and after that you want to type your I.D. which stands
for session I.D. equals and then type you.
Any random number.
So for me I will type your 5 5 5 and we also want to put the entire link between quotes so a traffic
indicates the code stands for referring to a certain page.
So when someone clicks on this it will lead them to this page.
But we added the session I.D. so it bleed into the same page but it will have the session I.D. already
pre configured by us in the link.
So once you do that you want to make sure that the page is correct.
So as we can see pet goat attack is the same as here but the web code is capital W and capital G right
here.
So we want to change that in doing as well so capital G capital W.
And once we do that you can send the email we specify that will take session a D or not fake our session
I.D. for the victim to be 5 5 5.
So if you click some link and log in with that session I.D. we will be able to to access that account.
So if we send an e mail as an attacker we can see we can turn the intercept off.
So let us just turn this off right here and we get to this stage two of this attack as we can see you
completed stage 1.
Now we are acting as a victim.
So let's say the victim received this e-mail which was the e-mail that we sent right now.
And this is the link that we specified the session I.D. as you can see down here in the left corner
of the page we can see the entire link and we can also see our session I.D. specified as as I.D. equals
five five five.
So let's say the victim gets this e-mail and it looks like a legit email and it clicks on this.
It will lead her or him to a log in page where it will ask them for username a password just as any
other page.
But if we can see right here on the link we already have our session I.D. specified and as soon as someone
types here and logs in we will be able to access that account.
Now we also want to ask act as a victim right here.
And as we can see State Street the bank has asked you to verify your data log in to see if your details
are correct your user name is changed in your password.
It starts up.
So just typed you Jane and Tarzan his password and you click here on Dan's safe now.
It says it is time to steal the session now use following link to reach good Hill's financial your hacker
Joe you completed stage 3 so we know that the Jane has logged into the bank account and what we want
to do we want to basically go to our lock screen.
So this is just a regular lock screen and we as a hacker want to log into that session that we do not
know the user name and password for that session.
We only know the session I.D. So what we want to do is turn the intercept on and right here we type
here.
Anything which is not correct so just type your anything random.
And here we will have the request both request.
Now if you were to just forward this it will save wrongly name or password since this is of wrong username
or password.
But what we want to do right here is we want to go up and find the link as we can see right here this
link and under that essay.
We want to change that to the session of our victim and we know that because we set it in the link to
be 5 5 5 and now if we forward this packet it will basically log in into the victim's account without
us even knowing the username password as we can see with type something random random user name random
password.
And if you click here forward we can see congratulations you have successfully completed session and
we are in victim's account first name.
Jane last name plane credit card type and see credit card number.
And then this.
So this is an attack that you might encounter.
So that's why it's called the session fixation since we even before our victim has logged in.
We already fixed the session in the link in order for us to know it later on once the target has logged
in with that session so that's a motive for this attack.
In the next tutorials we will continue with the pursuit.
And from now on I hope you're having a great day and take care.
By.