Session ID Capture

intermediateSupporting Technique

Extracting session keys from cookies, URLs, or web pages to gain unauthorized access to active user sessions.

Detailed Overview

Session identifiers are unique tokens that authenticate user sessions. These IDs can appear in cookies, URL parameters, or hidden form fields. Attackers capture these identifiers through network monitoring, cross-site scripting, or by exploiting insecure session management practices. URLs containing session IDs are particularly vulnerable as they can be logged, cached, or shared inadvertently.

Prevention Strategies

01Never expose session IDs in URL parameters
02Generate cryptographically random session IDs
03Implement session ID rotation after privilege changes
04Use long, complex session identifiers
05Implement session binding to IP address or user agent

Tools

Common software used to explore or defend against this technique.

Burp Suite
OWASP ZAP
Browser DevTools
mitmproxy

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Find session-like query params

python

Crawl HTML on a lab target and flag query params that look like session tokens.

import re
from urllib.parse import urlparse, parse_qs
import requests

SESSION_KEYS = re.compile(r"(session|sid|jsessionid|phpsessid)", re.I)

def flag_session_params(url: str) -> list[str]:
    html = requests.get(url, timeout=10).text
    found = []
    for m in re.finditer(r'href=["\']([^"\']+)["\']', html):
        q = parse_qs(urlparse(m.group(1)).query)
        for key in q:
            if SESSION_KEYS.search(key):
                found.append(key)
    return sorted(set(found))

print(flag_session_params("https://lab.example.com"))

Entropy estimate for token samples

python

Rough Shannon entropy check to spot weak session ID patterns in lab samples.

import math
from collections import Counter

def shannon(s: str) -> float:
    n = len(s)
    if n == 0:
        return 0.0
    return -sum((c / n) * math.log2(c / n) for c in Counter(s).values())

samples = ["abc123", "9f3a2c1b0e8d7f6a5c4b3a29180716f5"]
for tok in samples:
    print(tok, round(shannon(tok), 2))