Weak Session IDs
By Malcolm McDonald Founder, Editor-in-ChiefAuthor of Grokking Web Application Security
Guessable session IDs make your website vulnerable to session hijacking.
- Prevalence
- Rare
- Exploitability
- Easy
- Impact
- Devastating
What are weak session IDs?
Weak session IDs are a session management vulnerability in which an application generates session identifiers that are short, sequential or otherwise predictable. Attackers exploit them in a session hijacking attack, guessing or enumerating values until one matches a live session. They can then act as that user without ever knowing the username or password.
What you'll learn
- Why short or predictable session IDs can be guessed in bulk
- How a guessed session ID hijacks a session without a password
- Why built-in session management beats writing your own
Where this lesson counts
OWASP Top 10
Weak passwords, guessable sessions and leaky login flows let attackers assume other identities.
Learn more about A07This lesson includes
Weak Session IDs lab
Mal notices your site's session cookie holds a surprisingly short ID. Follow him as he writes a script to try IDs in bulk, runs it in parallel, finds ones your server has already issued and plugs one into his browser to hijack a session.
How to prevent Weak Session IDs
The prevention guide covers two approaches:
- Use Built-In Session Management
- Tamper-Proof Your Cookies
Weak Session IDs quiz
Three questions. Passing marks the lesson complete.
Glossary terms
Related lessons
Browse all 45 lessons
Session Fixation
Insecure treatment of session IDs can leave your users vulnerable to having their session hijacked.
Password Mismanagement
Safe treatment of passwords is essential to a secure authentication system - yet many websites get this wrong.
Cross-Site Scripting
If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript.
Unencrypted Communication
Insufficient encryption can make you vulnerable to monster-in-the-middle attacks.