From the course: CompTIA Security+ (SY0-701) Cert Prep: 2 Threats, Vulnerabilities, and Mitigations

Unlock the full course today

Join today to access over 23,200 courses taught by industry experts.

Session hijacking

Session hijacking

From the course: CompTIA Security+ (SY0-701) Cert Prep: 2 Threats, Vulnerabilities, and Mitigations

Start my 1-month free trial Buy for my team

Session hijacking

“

- [Instructor] Cookies are often used for web application authentication. After a user logs into a system, the web server provides a cookie so that the user doesn't need to continuously log into the system every time they request a new webpage. Presenting the cookie with each request causes the web server to reference the earlier successful login. One major flaw in some web applications is that they don't use random cookies. Instead, they use a guessable value. Let's go ahead and take a look at an example. Once again, we'll turn to the WebGoat Application Security Demonstration Tool and the ZAP Web Proxy. This time, we're using a simple web application that asks for a username and a password and has a login button. I have two accounts that I know exist on this server, and I'm going to go ahead and start the ZAP Application Proxy and tell it to intercept the login request. I go back to the application. The first…

Contents