Session Hijacing Theory

[Moonbat]

I was thinking to myself what a wonderful world, then I woke up. Afterwards I thought this up.

Okay, suppose you have a social networking site called [url]http://www.friends.com[/url]. Now suppose this site, when you login, stores your PHP session ID as a get variable, i.e.

http://www.friends.com/profile.php?SESSID=aaaea***0fa*bc00**df6cedb*7b*cb0

Now, (yes another hypothetical) suppose I posted a link on my profile to my external site [url]http://www.mysitezor.com[/url]. When the other users of the site click it they will be taken to my site. I will have a nice little log file showing refferer information. So, later, shouldn't I be able to go to my log file and see their refferer information, right? It should look like this (psuedo).

IP - 6*.***.66.***
Hostname - <insert random hostname here>
Refferer - http://www.friends.com/profile.php?SESSID=aaaea***0fa*bc00**df6cedb*7b*cb0

Since the SESSID was stored as a GET var, it shows up right? So shouldn't I be able to login to my Friends.com account and change my cookie's SESSID value to the one that I got from the refferer information, thereby hijacking the victim's session?

Just a theory, feedback would be nice.

[Noodles]

did you try it moonbat? supposing alone wont get you anywhere. try it and tell us/

[Ezekiel]

Websites mostly use cookies to authenticate users, and PHP sessions simply to ***** users' actions on the site regardless of their login status.

Of course all sites are different, but it would be very dangerous to use PHP sessions as a basis for authentication when the referrer can be logged by any site they click a link to, thus compromising their account.

You'd need a user's cookie(s) to hijack their account, as far as I've seen.

By the way, I moved this to Internet Privacy.

[Moonbat]

I have yet to find any site that is vulnerable to this sort of attack, so until further notice this theory is busted.

[Noodles]

i thought you pro guys, like make websites for experimentation.

no body will care if you deface / hack your website....i guess.

make a web which is vulnerable and ..... or is it difficult too compose a vulnerable website?

[Ezekiel]

make a web which is vulnerable and ..... or is it difficult too compose a vulnerable website?

Not difficult really, but I don't have the time at the moment for any more projects.

[Moonbat]

i thought you pro guys, like make websites for experimentation.

no body will care if you deface / hack your website....i guess.

make a web which is vulnerable and ..... or is it difficult too compose a vulnerable website?

Well, I was thinking up this theory based on the assumption that after normal user/passwrod authentication, the server only authenticated you based on the SESSID.

I have some other things on my e-plate I need to start and/or finish, so this theory will have to take a backseat to them.