Session hijacking is a cyberattack where an attacker gains unauthorized access to a legitimate user’s active session on a website or application by stealing or predicting the session identifier (often called a session token or session ID). This session ID is a unique token generated by the server when a user logs in and is used to authenticate the user’s requests during that session.
When attackers obtain this session ID—through methods like sniffing network traffic, exploiting web vulnerabilities, or infecting devices with malware—they can impersonate the user, access sensitive information, perform unauthorized actions, and bypass authentication controls. This type of attack is particularly dangerous because it allows the attacker to act with the same privileges as the victim, often without needing to know the user’s password or credentials.
A user logs in, and the server creates a session ID to track the user’s activity. The attacker obtains the session ID using various techniques, such as: (1) Packet sniffing on unsecured networks (session sidejacking) (2) Cross-site scripting (XSS) to steal cookies (3) Session fixation, where the attacker sets a known session ID before the user logs in (4) Malware that extracts session tokens from the user’s device. Finally, the attacker uses the stolen session ID to access the web application as the victim, often without raising immediate suspicion.