Home 0P3N Blog Preventing Authentication Bypass with SessionID
Ready to Start Your Career?
Create Free Account
By: sranjanbehera
March 3, 2017

Preventing Authentication Bypass with SessionID

By: sranjanbehera
March 3, 2017
By: sranjanbehera
March 3, 2017


What is SessionID?SessionID is a unique ID for checking the authentication of a logged on user. Based on the SessionID the Server responds to a browser. And the Session Hijacking involves, accessing the random sessionID based on user input. This sessionID is being used for both the Web and Mobile applications. Authentication Bypass places a major stack in application vulnerability.

Possible hybrid strings from user input.username+stringpassword+stringusername+passwordusername+date+string

Here, '+' is used to concatenate two different strings.

The following code could be helpful in order to crosscheck the severity based on the SessionID.

class SessionProgram{static string randomString(int length){const string validChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789”  //This is the value for defining the string                                stringBuilder res = new StringBuilder();           // Creating Null ObjectRandom rnd = new Random();while (0 < length --){res.Append(validChars[rnd.Next(validChars.Length)]);}}             //End of randomString()                static void Main(string[] args){int length = Console.Read();string usedCase = Console.ReadLine();      // Get string from userstring hybridPass = randomString(length);Console.WriteLine(hybridPass +usedCase);}}

This is a program based on C#. In order to try this code, import the following modules and define this whole SessionProgram class under a Namespace.using System;

using System.Collections.Generic;using System.Linq;using System.Text;using System.Threading.Tasks;

This payload can be used to get sample permutations of various username/password and random strings. The same can be modified for a set of used cases only. Edit the constant string ‘validChars’ with a frequently used parameter value.

**This is for educational purposes only.**

Request Demo

Build your Cybersecurity or IT Career

Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry