Is it possible to hack someone's session variables and create a new shadow user?
What are the common ways of avoiding such surprizes?
SSL certificate installation or ....?
That post specifically has to do with Session Storage in PHP not in ASP.NET
Eoin Campbell
2009-06-05 10:11:14
Thanks Eoin- I posted the wrong link by mistake. Too much of a late one last night. :-)
RichardOD
2009-06-05 11:49:26
+4
A:
Short answer... it depends.
Session in ASP.NET can be stored in a variety of ways (InProc / SQL Server / State Server) etc... another thing to note is how the client session is maintained (query string value, cookies etc...)
As the poster in this answer suggests
One thing you could do when you authenticate the user and store their name in Session, would be to also store some other information about them. e.g. Their UserAgentString, their IP Address and if a different IP or UserAgentString attempted to interact with the session, you could invalidate it.
Eoin Campbell
2009-06-05 10:15:29
One thing: storing IP against session is good, but not foolproof, the problem being that a common form of session hacking is against someone within the same IP group (i.e. within a company or AOL). Similar concerns for UserAgent (only with much higher commonality!)
annakata
2009-06-05 10:31:09
+1
A:
Anything is possible, however by default it's hard.
Generally you hijack a session by stealing the session cookie and recreating it on another machine. However in order to do this the web site must be vulnerable to Cross Site Scripting (which you can mitigate against with Server.HtmlEncode when you echo user input back). If if you do end up vulnerable the ASP.NET session cookie is marked as HTTP Only, which means, if a browser supports it, it is not accessible to access from client side scripts (although Safari ignores this setting).
blowdart
2009-06-05 10:17:16
A:
Hello, In my website I am maintaining log of users in which I am storing some user's information such as user machine IP number,SessionId,UserName etc.and able to show the list of current and past users in webpage.
I want to share a browser session of my current users.suppose there are many users who is accesing my site and if I click any perticular user then we can find the user's session and able to know the working of users. Is it possiable,if yes then how ? Please tell me......
Thanks to all.