Session hijacking

Dec 27, 2013Download as pptx, pdf

0 likes536 views

Adam Ka?par

Session
? Slou?í k identifikaci mezi jednotliv?mi
requesty
? P?enos p?es HTTP protokol
? Zp?sob p?enosu:
?
?
?

Parametr v URL
Skryté formulá?ové pole
Cookies

? SESSIONID=KBY1T2ywyKtQULVDJfiU1ChG;

Session fixation
? Session se ulo?í p?ímo do URL
? Zaslání URL oběti
? Po p?ihlá?ení oběti se pou?ije session z
URL
? Stránky musí podporovat znovupou?ití
vyexpirované session
? Slu?by:

Session sidejacking
? Uko?istění platné session cookie
? Lze vyu?ít k neautorizovanému p?ístupu k
webov?m slu?bám, soc. sítím atd.
? Session lze zachytit pomocí packet
sniffingu mezi klientem a serverem
(Wireshark)

Session sidejacking
? Funguje pouze pro nezabezpe?ená
spojení a sítě
? Web sites pou?ívají SSL spojení pouze
pro autentizaci – náro?né na v?kon
? Slu?by:
? Prost?edí:V?B tuonet-simple, free hotspoty

Facebook sidejacking
? Session v cookie s názvem datr
? P?ekopírovat do hlavi?ky nového
po?adavku
? Session aktivní a? do odhlá?ení u?ivatele
? http://www.youtube.com/watch?v=1Gyz0_bSioI&
feature=youtu.be

Facebook sidejacking
? Povolit promiskuitní re?im na sí?ové kartě
? Automatizované nástroje jako firesheep
? Ochrana proti sidejackingu:
? p?ipojování do zabezpe?en?ch a d?věryhodn?ch sítí
? zapnout podporu SSL protokolu (nutná podpora serveru)

The document summarizes the Easycure mobile healthcare app, which aims to connect doctors and patients anytime, anywhere in India. The app allows patients to get medical advice and consult doctors remotely, while also allowing doctors to help more patients. It functions like an online marketplace by connecting users to qualified doctors, medical stores, diagnostic centers, and ambulance services. Users can book appointments, consult doctors by phone/video, order medicines for delivery, and more. The document outlines Easycure's value proposition, features, pricing, management team, processes, growth strategy, and disclaimer.

映画监督、映像作家が知っておくべき、ファンを巻き込んだ作品作りの方法schoowebcampus

ーーーーーーーーーーーーーーーーーーーーーーー schoo WEB-campusは「WEBに誕生した、学校の新しいカタチ」。ＷＥＢ生放送の授業を無料で配信しています。 ▼こちらから授業に参加すると、先生への質問や、ユーザーとのチャット、資料の拡大表示等が可能です。 https://schoo.jp/class/932/room ーーーーーーーーーーーーーーーーーーーーーーー

世界一周は０円で行け！ピースボートスタッフが教える「これから」のグローバル力schoowebcampus

苦手意识を克服！数的センス向上入门讲座（第ニ回：分析力编）schoowebcampus

ーーーーーーーーーーーーーーーーーーーーーーー schoo WEB-campusは「WEBに誕生した、学校の新しいカタチ」。ＷＥＢ生放送の授業を無料で配信しています。 ▼こちらから授業に参加すると、先生への質問や、ユーザーとのチャット、資料の拡大表示等が可能です。 https://schoo.jp/class/659/room ーーーーーーーーーーーーーーーーーーーーーーー

Benefits of using IMPLAlkis Vazacopoulos

The document discusses the benefits of IMPL (Industrial Modeling and Programming Language), a tool for optimization in industrial planning and scheduling. IMPL aims to maximize profit, performance, and minimize penalties. It can model both planning and scheduling objectives together, capturing all decision-making benefits. Using IMPL for crude oil scheduling optimization at an oil refinery improved quality consistency and increased profits by over $10 million per year. IMPL helps users achieve tangible benefits like these from advanced planning and scheduling optimization more quickly.

ADF Software Factory - Software aus der Werkstattenpit GmbH & Co. KG

Das Dokument beschreibt die Konzepte und Anforderungen einer ADF Software Factory, die eine industrielle Herangehensweise an die Softwareentwicklung darstellt. Es werden methodische Ans?tze zur Modularisierung, Wiederverwendung von Komponenten sowie zur Automatisierung des Entwicklungsprozesses vorgestellt. Zudem werden Werkzeuge, Organisation und Qualit?tssicherungsprozesse behandelt, um eine effiziente Softwareentwicklung zu erm?glichen.

Higher Purpose and Stakeholder OrientationPollenStrategy

The document discusses the concept of stakeholder orientation and higher purpose in business. It argues that businesses should view themselves not just in economic terms but also consider their impact on society and the environment. It presents a model that shows how moving from shareholder capitalism to sustainable/conscious capitalism involves expanding one's view from self-interest to considering the interests of society and the environment. The document also discusses how the presenter started their own business with the goal of making a net positive contribution to stakeholders beyond just shareholders.

英语で电话する际のシチュエーション别演习（最低限のパターン编）　先生：小林　あつしschoowebcampus

ーーーーーーーーーーーーーーーーーーーーーーー schoo WEB-campusは「WEBに誕生した、学校の新しいカタチ」。ＷＥＢ生放送の授業を無料で配信しています。 ▼こちらから授業に参加すると、先生への質問や、ユーザーとのチャット、資料の拡大表示等が可能です。 https://schoo.jp/class/860/room ーーーーーーーーーーーーーーーーーーーーーーー

A k?zoktatásról szóló 1993Drahos Andrea

NIRI Annual Conference - 2014 Program BookIR Smartt Inc.

The 2014 NIRI Annual Conference, themed 'Extreme IR,' is set to take place in Las Vegas from June 8-11, 2014, focusing on advancing the investor relations profession and enhancing career development. The conference features various sessions, networking opportunities, and an experience showcase aimed at equipping participants with leading practices and tools for navigating the challenges in investor relations. Attendees are encouraged to engage, share ideas, and participate in activities to maximize their experience at the world's largest IR event.

Embrace The EvolutionChristopher Kappes

Chris Kappes is an experienced marketing and sales professional who has worked at several exhibit and event companies. He has learned that clients want measurable outcomes from exhibits and events but for lower costs. The trade show industry is facing challenges like commoditization and price pressure that require innovation. Matrex is evolving from a traditional design agency to focus on creating quantifiable outcomes through integrated offerings and strategic alliances in order to unlock enterprise value for clients.

2012 SEO For Press ReleasesIR Smartt Inc.

This document discusses strategies for optimizing press releases for search engines (SEO). It recommends including multimedia content like images, videos and slideshows embedded from social media sites. Deep linking to internal pages on the company website and including keywords in captions and metadata. It also suggests creating podcasts or audio files and providing media packages for bloggers to encourage republishing the content. The goal is to distribute the press release widely and generate backlinks to improve search engine rankings.

Poverty - G2Bernard Sng

Poverty is defined as the state of being extremely poor and lacking material possessions or money. Many developing countries have high poverty rates, with over 48% of people in Africa and over 20% in India and Cambodia living in poverty. Poor people often experience abuse of power, a lack of security, and weak community support. To help, one can donate part of their income, visit poor areas, or spread information about poverty online.

Prezentare Your Promo InnovatyAndreea Vladau

Alat inderaMuhammad Noval

Catalunya n? 178 Gener 2016Revista Catalunya

世の中を変える色んな面白い人が持ち时间500秒でチラミセします！颁濒颈辫「チラミセ苍颈驳丑迟」惫辞濒.2schoowebcampus

Basisbedrijfsmodel TerreinbeheerFrank Steeneken

Het Basisbedrijfsmodel Terreinbeheer beschrijft de onderliggende functionele systeemstructuur van een Terreinbeherende Organisatie (TBO). Het model introduceert een raamwerk voor beheersing van de complexiteit inherent aan terreinbeheer en een herbruikbaar concept waarmee de werkzaamheden van een terreinbeheerder zichtbaar worden gemaakt. Het Basisbedrijfsmodel Terreinbeheer laat zien wat een terreinbeheerder doet om zijn primaire functie te vervullen. Door een TBO als één functioneel systeem te beschouwen wordt de aard van de onderliggende kernprocessen duidelijk. Door ze daarna als onderdelen van één geheel te managen en te verbeteren, kunnen substanti?le verbeteringen worden bereikt op de prestatie-indicatoren van resultaatgebieden.

Session hijacking

1. Session hijacking Adam Ka?par, kas381 adam.kaspar@gmail.com 27.12.201 3

2. Session ? Slou?í k identifikaci mezi jednotliv?mi requesty ? P?enos p?es HTTP protokol ? Zp?sob p?enosu: ? ? ? Parametr v URL Skryté formulá?ové pole Cookies ? SESSIONID=KBY1T2ywyKtQULVDJfiU1ChG;

3. Session fixation ? Session se ulo?í p?ímo do URL ? Zaslání URL oběti ? Po p?ihlá?ení oběti se pou?ije session z URL ? Stránky musí podporovat znovupou?ití vyexpirované session ? Slu?by:

4. Session fixation

5. Session sidejacking ? Uko?istění platné session cookie ? Lze vyu?ít k neautorizovanému p?ístupu k webov?m slu?bám, soc. sítím atd. ? Session lze zachytit pomocí packet sniffingu mezi klientem a serverem (Wireshark)

6. Session sidejacking ? Funguje pouze pro nezabezpe?ená spojení a sítě ? Web sites pou?ívají SSL spojení pouze pro autentizaci – náro?né na v?kon ? Slu?by: ? Prost?edí:V?B tuonet-simple, free hotspoty

7. Facebook sidejacking

8. Facebook sidejacking ? Session v cookie s názvem datr ? P?ekopírovat do hlavi?ky nového po?adavku ? Session aktivní a? do odhlá?ení u?ivatele ? http://www.youtube.com/watch?v=1Gyz0_bSioI& feature=youtu.be

9. Facebook sidejacking ? Povolit promiskuitní re?im na sí?ové kartě ? Automatizované nástroje jako firesheep ? Ochrana proti sidejackingu: ? p?ipojování do zabezpe?en?ch a d?věryhodn?ch sítí ? zapnout podporu SSL protokolu (nutná podpora serveru)

10. Děkuji za pozornost.

狠狠撸

Session hijacking

Recommended

More Related Content

Viewers also liked (11)

Session hijacking