Session Management (SMA)

Players can discuss any type of Session Management (SM) attack they think might be possible against the assessment target. It does not matter if the attack relates to another SM card, but if possible try to identify an attack that is fairly unique to the application/functionality/users.

Scenario: Invent your own Session Management threat

Inventing a new session management attack could lead to:

1. Session Hijacking / Impersonation: Attacker takes over another user’s active session.
2. Session Fixation: Attacker forces a victim to use a session ID they know.
3. Privilege Escalation: Attacker uses session manipulation to gain admin or sensitive access.
4. Information Leakage: Sensitive user data or tokens could be exposed.
5. Replay / CSRF-like attacks: Reusing a valid session to perform unauthorized actions.
6. Service Disruption: Exhausting session tables or server resources through massive session creation.
7. Loss of Auditability: Actions performed via hijacked or manipulated sessions may not be attributable.

Threat modeling

STRIDE

STRIDE categories affected, depends on the context. Potentially, all six may be affected (Spoofing, Tampering, Repudiation, Information Disclosure, Elevation of Privilege, Denial of Service).

What can go wrong?

Hijacking, escalation, data leaks, denial of service, loss of auditability.

What are you going to do about it?

Use strong session IDs, secure cookies, enforce timeouts, re-authentication, centralized session management, monitoring, and periodic testing.

Best Practices / Mitigations for Session Management threats would be:

1. Strong Session Identifiers: Use cryptographically random, long, and unpredictable session IDs.
2. Secure Storage and Transmission: Cookies: HttpOnly, Secure, SameSite and avoiding putting session IDs in URLs.
3. Session Expiration: Inactivity timeouts and absolute session lifetimes.
4. Session Binding: Bind sessions to IP addresses, devices, or user agents when feasible.
5. Re-authentication for Critical Actions: Ask users to log in again for sensitive operations.
6. Invalidate Old Sessions: After logout, password change, or role change.
7. Monitor & Detect: Detect concurrent sessions, unusual access patterns, or abnormal session behavior.
8. Centralized Session Management: Avoid custom implementations; use framework-standard, tested routines.
9. Audit and Logging: Log session creation, invalidation, and unusual activity.
10. Periodic Security Testing: Include fuzzing, stress tests, and penetration testing against session controls.