CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
Last updated
Overview
CAPEC-60 (Reusing Session IDs (aka Session Replay)) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
The attacker interacts with the target host and finds that session IDs are used to authenticate users.
- Step 2Explore
The attacker steals a session ID from a valid user.
- Step 3Exploit
The attacker tries to use the stolen session ID to gain access to the system with the privileges of the session ID's original owner.
What the attacker needs
Prerequisites
- The target host uses session IDs to keep track of the users.
- Session IDs are used to control access to resources.