Question
What are the two main attacks on sessions?
Answer
Session hijacking = stealing a victim's existing session ID; session fixation = planting a known session ID on the victim, then using it after they log in.
* Hijacking steals an existing session ID; fixation plants a known one and rides it once the victim logs in. *
| Attack | Description | Direction |
|---|---|---|
| Session Hijacking | Stealing a session ID from a victim's system | Attacker ← Victim |
| Session Fixation | "Planting" a session ID into a victim's system | Attacker → Victim |
Session Hijacking methods:
- XSS to steal cookies
- Network sniffing (if not HTTPS)
- Malware on victim's machine
Session Fixation: Attacker creates a session, tricks victim into using it, then hijacks the authenticated session.
Go deeper:
Session hijacking (Wikipedia) — how a live session ID gets stolen (XSS, sniffing) and the countermeasures.- Session fixation (Wikipedia) — the plant-then-ride attack and why regenerating the ID on login defeats it.
Note saved — thanks!
Question
What is Information Disclosure in STRIDE and what security property does it violate?
Answer
Exposing information to someone not authorized to see it — it violates Confidentiality.
Information Disclosure:
| Aspect | Description |
|---|---|
| Property violated | Confidentiality |
| Definition | Exposing information to an unauthorized target |
| Examples | Publishing confidential customer data to a website, data breaches |
Real-world example: a fitness-tracking app published an aggregate "heat map" of users' running routes; in remote regions the only runners were soldiers, so the map inadvertently revealed secret military base outlines and patrol patterns — harmless-looking data leaking sensitive information when combined.
Mitigation:
- Encryption at rest and in transit
- Access controls
- Data classification
- Privacy by design
Note saved — thanks!