# Session hijacking

> Stealing the ticket a site gives you after login, so the thief is let in as you.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/session-hijacking/
- In Spanish: [Secuestro de sesión](https://tidbit.legios.com.ar/es/session-hijacking/)

When you log in to a website, you do not send your password with every click. The site checks it once and hands your browser a **session token**, usually stored in a cookie: a long random string that means "this person already logged in". Every later request carries it, and the site lets you in. **Session hijacking** is stealing that token. Whoever holds it is treated as you, no password needed.

The nasty part is that it skips two-factor authentication too, because the second factor was already checked at login. That is why attackers love it. The most common route today is **infostealer** malware: a fake game mod, a cracked program or a booby-trapped download quietly copies the cookies saved in your browser and sends them off. Other routes are cross-site scripting bugs that let a script read the cookie, or an unencrypted connection that someone in the middle can watch.

Sites defend with several layers. Cookies marked `HttpOnly` cannot be read by page scripts, and `Secure` ones only travel over HTTPS. Sessions expire, and a sensitive action such as changing your email or sending money asks for the password again. Many services also watch for a session suddenly showing up from another country or device. For you, the useful habits are: log out on shared computers, use 'sign out of all sessions' if something looks off, and do not install software from shady sources.

## An analogy

A concert wristband. Security checks your ID once at the door and then only looks at the band. If someone cuts it off your wrist and puts it on, they walk past the guards as you.

## Keep in mind

- After login, a session token in a cookie proves who you are on every request.
- Stealing it skips both the password and two-factor authentication.
- Infostealer malware that copies browser cookies is the most common way in today.
- 'Sign out of all sessions' kills stolen tokens; HttpOnly and Secure cookies make theft harder.

## Go deeper

- [Session hijacking on Wikipedia](https://en.wikipedia.org/wiki/Session_hijacking)
- [Session hijacking attack (OWASP)](https://owasp.org/www-community/attacks/Session_hijacking_attack)

## Related terms

- [Website](https://tidbit.legios.com.ar/website/): A set of web pages under one address, stored on a server and opened in a browser.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [Token](https://tidbit.legios.com.ar/token/): The small chunk of text a language model actually reads.
- [Cookies](https://tidbit.legios.com.ar/cookies/): Small notes a website asks your browser to keep, so it can recognize you later.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.
- [Malware and ransomware](https://tidbit.legios.com.ar/malware-and-ransomware/): Software built to harm you; ransomware locks your files and charges to unlock them.
- [Cross-site scripting](https://tidbit.legios.com.ar/cross-site-scripting/): Sneaking code into a website so it runs in other visitors' browsers.
- [Bug](https://tidbit.legios.com.ar/bug/): A mistake in software that makes it behave differently from what was intended.