Hackry0DeBian

int main () {
int a[5] = {22, 24, 34, 45, 35};
int *ptr = a;
ptr = a;

printf("%d\n", *ptr, ptr);
ptr++;
printf("%d\n", *ptr, ptr);
ptr++;
printf("%d\n", *ptr, ptr);
ptr-=2;
printf("%d\n", *ptr, ptr);
ptr--;

return 0;
}

Session hijacking attacks exploit a valid web session to gain access to a computer network or system. Session hijacking is also informally known as cookie hijacking.

Since there are several TCP connections involved in HTTP networking, there is often a method involved in the identification of web users. Whether a particular method is suitable is determined by a session token sent by a web server to the user’s browser following successful authentication. A session ID or session token is a string of varying lengths given to a visitor upon their first visit to a site. There are many ways to incorporate a session ID; it can be worked into the URL or the header of the https request received, or stored as a cookie.

Most browser sessions and web applications are susceptible to session ID attacks, though most can be used to hijack just about any system out there.

Session hijacking attacks, or cookie hijacking attacks, steal or imitate a session token to gain access to a system.

There are several different ways to compromise a session token:

By predicting a weak session token

Through session sniffing

By means of client-side attacks (XSS, malicious JavaScript Codes, Trojans, etc.)

Through man-in-the-middle (MITM) attacks (phishing, etc.)

This article provides a short guide on conducting a pen-testing session to check whether a system is prone to the attacks mentioned above.

Some pre-requisites:

A predetermined soft-target to perform this test on

A local machine with an up-to-date version of Kali Linux installed

A web browser

More specifically, we will be using the Ettercap, Hamster, and Ferret built-in utilities known for their use in conducting MITM attacks.