ASP session Spoofing

I read the lcx prawn article last time. I don't understand it. I tried to set up an environment today. Yeah, I understand it. Haha, hurry up and blog ~

Session is the interaction information state between the client browser and the server. Each connection between different users will get different sessions. In other words, the server tracks and identifies users through sessions, so now this blog knows that I am admin, And you are guest :)

Open a browser. When you access the asp file of a site for the first time, the server will Set the user's session (for example, Set-Cookie: ASPSESSIONIDGQGGQAFC = FPGBGNOCAGPLAPOFOPJGODCJ). When you access this site later, the browser will submit this data until the user exits or the session expires (the session is no longer accessed for 20 minutes by default in IIS ).

For IIS, the cookie value ASPSESSIONIDXXXXXXXX submitted by the browser determines the user. If we can get the data of Valid users, we will change the submitted cookie value to the target user. You will be surprised to find that our identity is already the user, ha, this is the legendary session spoofing.

Cross-Site cookie is acceptable, but session is troublesome. The Session will soon expire, unless it's okay to wait until the target moves immediately, or even if the session has expired for N long.

On the other hand, since a script is used to get the cookie, why not use this script to directly forward the obtained cookies back? Asp has a Microsoft. XMLHTTP object that can be used to send requests (Get and Post) to the web server. In this way, you can quickly send any request as the target user before the session becomes invalid. We can also do what the user can do. The specific data depends on the web program.

By: lake2

From: http://blog.csdn.net/lake2/