Session Hijacing Theory

I was thinking to myself what a wonderful world, then I woke up. Afterwards I thought this up.

Okay, suppose you have a social networking site called [url]http://www.friends.com[/url]. Now suppose this site, when you login, stores your PHP session ID as a get variable, i.e.
[CODE]http://www.friends.com/profile.php?SESSID=aaaea***0fa*bc00**df6cedb*7b*cb0[/CODE]
Now, (yes another hypothetical) suppose I posted a link on my profile to my external site [url]http://www.mysitezor.com[/url]. When the other users of the site click it they will be taken to my site. I will have a nice little log file showing refferer information. So, later, shouldn't I be able to go to my log file and see their refferer information, right? It should look like this (psuedo).
[CODE][B]IP[/B] - 6*.***.66.***
[B]Hostname[/B] - <insert random hostname here>
[B]Refferer[/B] - http://www.friends.com/profile.php?SESSID=aaaea***0fa*bc00**df6cedb*7b*cb0[/CODE]

Since the SESSID was stored as a GET var, it shows up right? So shouldn't I be able to login to my Friends.com account and change my cookie's SESSID value to the one that I got from the refferer information, thereby hijacking the victim's session?

Just a theory, feedback would be nice.

did you try it moonbat? supposing alone wont get you anywhere. try it and tell us/:D

Websites mostly use cookies to authenticate users, and PHP sessions simply to ***** users' actions on the site regardless of their login status.

Of course all sites are different, but it would be very dangerous to use PHP sessions as a basis for authentication when the referrer can be logged by any site they click a link to, thus compromising their account.

You'd need a user's cookie(s) to hijack their account, as far as I've seen.

By the way, I moved this to Internet Privacy.

I have yet to find any site that is vulnerable to this sort of attack, so until further notice this theory is busted. :(

i thought you pro guys, like make websites for experimentation. :confused:

no body will care if you deface / hack your website....i guess.

make a web which is vulnerable and ..... or is it difficult too compose a vulnerable website? :)

[QUOTE=Noodles;242*7]
make a web which is vulnerable and ..... or is it difficult too compose a vulnerable website? :)[/QUOTE]

Not difficult really, but I don't have the time at the moment for any more projects.

[QUOTE=Noodles;242*7]i thought you pro guys, like make websites for experimentation. :confused:

no body will care if you deface / hack your website....i guess.

make a web which is vulnerable and ..... or is it difficult too compose a vulnerable website? :)[/QUOTE]

Well, I was thinking up this theory based on the assumption that after normal user/passwrod authentication, the server only authenticated you based on the SESSID.

I have some other things on my e-plate I need to start and/or finish, so this theory will have to take a backseat to them.

[QUOTE=Moonbat;2425*]
I have some other things on my e-plate I need to start and/or finish, so this theory will have to take a backseat to them.[/QUOTE]

I'm gonna have to steal the phrase "e-plate" from you.

kthx.

You're welcome :D

Hi guys - I know your probably already rolling your eyes as soon as you seen the title of this message. I was searching the internet for ways to hack a users myspace page - when I mean hack - I mean I want to see who the no-good bastard is cheating on me with. I know a tad about code - went to school for programming over 7 years ago - switched major to design (don't hate me) so I'm:eek: a little rusty. Anyway when I did a search - it brought me to you - so here I am. I read a few of your posts on the subject - did you ever figure out if it is doable?

As of now MySpace has no security vulnerabilities that we know of.

[QUOTE=dandi*0**0;24277]Hi guys - I know your probably already rolling your eyes as soon as you seen the title of this message.[/QUOTE]

:rolleyes:
:rolleyes:
:rolleyes:

Yeah.

Usually, the easiest (and most effort-free) way to gain access to any web account is phishing, but this isn't really relevant to the current thread.

[QUOTE=mike*5*;24284]Usually, the easiest (and most effort-free) way to gain access to any web account is phishing, but this isn't really relevant to the current thread.[/QUOTE]

Is [I]anything [/I]ever relavent to the current thread? :rolleyes:

[QUOTE=Moonbat;242**]Is [I]anything [/I]ever relavent to the current thread? :rolleyes:[/QUOTE]

Not usually, but we allow thread-hijackings if they turn a boring thread into an interesting one.

Otherwise, we enforce the rules like the hypocrites we are.

pretty much a no-go. And either I did not pay attention in school or I just forgot everything I learned because half of what you posted was over my head. :o
So I guess my next question is. I recently put spyware on my page to see who is checking my profile out - problem is it can only give me an IP address. Is there a way to somehow do a reverse look-up on an IP address to get either a name or an email address?