Re: How to create (hijacking) secure HTTP sessions?

[Michael Decker <MDecker () tesis de>]

> You've missed two mechanisms that work 100%:
>
> * Use private client certificates and attach certificates to session IDs.

You're right. I've not thought about this, because it's not possible in
my case, but it should be named.

> * Use Digest for authentication. (Yes, I know, not very likely.)

I'll take a look...

> You can also add:
> * Session inactivity timeout.

That should be my "* Set HTTP session timeout"

> > * Only create HTTP session ID after login
>
> This should be "Re-generate session IDs after authentication takes
> place". In many situations you will need to have a proper session even
> before authentication, if not for anything else then for tracking
> purposes.

Here you're right, too. In my case, I can create a session only on log in.

> > * Using HTTPs
>
> Do not mix SSL sections with non-SSL sections.

What do you mean by this?

> Mark cookies "secure".

Thanks for that point!

> > * HTTP session ID joined with IP and SSL session ID
>
> Here you need to have in mind that there's nothing in the spec to say
> the browser must continue to use the same SSL session throughout the
> application session. So while this works in some circumstances it
> doesn't in many others.

You're right... IE don't do so:
http://support.zeus.com/zlb/faqs/2005/08/12/why_do_ssl_connections_to_ie_browsers_pe


Thanks a lot

-- 
Michael Decker                      Michael.Decker () tesis de
TESIS SYSware GmbH                      http://www.tesis.de
Baierbrunnerstr. 15 * 81379 Muenchen * Tel. +49 89 747377-0


-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. Change the way you 
think about application security testing - See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007kaF
--------------------------------------------------------------------------