Sequence Numbers

Sequence Number

• TCP provides a full duplex reliable stream connection between two end computers.

• Data is packeted into a number of data packets and every byte that is sent by a host is marked with a sequence number and is acknowledged by the receiver using this sequence number.

• Sequence numbers are a 32-bit counter, which means the value can be any of over 4 billion possible combinations.

• Sequence numbers ensure that the receiving machine re-assembles the data packets in the same order to obtain the original data as they were dis-assembled at the transmitting end.

• The sequence number for the first byte sent is computed during the connection opening.

• If a computer opens a new connection in addition to an existing connection, the initial sequence number for two different sessions are different.

• When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer using the sequence number used by the victim computer.

• Pseudo-random number generators (PRNGs) introduced some randomness when producing ISNs used in TCP connections, thereby, making ISNs harder to guess, but were still vulnerable to statistical attack

Threat

If a sequence number within the receive window is known, an attacker can inject data into the session stream or choose to terminate the connection. If the attacker knows the initial sequence number, he can send a simple packet to inject data or kill the session if he is aware of the number of bytes transmitted in the session this far.

Fig. INITIAL SEQUENCE NUMBER. Click to magnify.

Session Hijacking - How it Works?

Read the original post on SESSION HIJACKING

To understand and fullly appreciate this post, please read

• Understand the TCP/IP 3-way handshake
  
• Understanding the TCP layers & working
  
• Understanding the security issues and attacks involved in the use of IPv4 standard

Steps in Session Hijacking - How it Works?

• Tracking the connection

The attacker uses a network sniffer to track the victim and host or identify a suitable user by scanning with a scanning tool such as NMap to find a target with a trivial TCP sequence numbers prediction. This is done to ensure that because the correct sequence and acknowledgement numbers are captured. These will later be used by the attacker in crafting his own packets.

• Desynchronizing the connection

The connection can be desynchronized in many ways as described :

To desynchronize the connection between the target and host, the sequence number or the acknowledgement number (SEQ/ACK) of the server must be changed. This can be done if null data is sent to the server so that the server's SEQ/ACK numbers will advance; while the target machine will not register such an increment.

The attacker sends a reset flag to the server and breaks the connection on the server side and create a new one with different sequence numbers. The attacker listens for a SYN/ACK packet from the server to the host. On detecting the packet, he sends an RST to the server and a SYN packet with a different sequence number. The server on receiving the RST packet, closes connection with the target, but initiates another one based on the SYN packet - with a different sequence number on the same port. Having opened a new connection, the server sends a SYN/ACK packet to the target for acknowledgement. The attacker detects (but does not intercept) this and sends back an ACK packet to the server. Now, the server is in the established state. The target is oblivious to the conversation and has already switched to the established state when it received the first SYN/ACK packet from the server. Now both server and target are in desynchronized but established state.

This can also be done using a FIN flag, but this will cause the server to respond with an ACK and give away the attack through an ACK storm. This results due to a flaw in this method of hijacking a TCP connection. When receiving an unacceptable packet the host acknowledges it by sending the expected sequence number and using its own sequence number. This packet is itself unacceptable and will generate an acknowledgement packet which in turn will generate an acknowledgement packet, thereby creating a supposedly endless loop for every data packet sent. The mismatch in SEQ/ACK numbers results in excess network traffic with both the server and target trying to verify the right sequence. Since these packets do not carry data they are not retransmitted if the packet is lost. However, since TCP uses IP the loss of a single packet puts an end to the unwanted conversation between the server and target on the network.

The desynchronizing stage is added in the hijack sequence so that the target host is kept in the dark about the attack. Without desynchronizing, the attacker will still be able to inject data to the server and even keep his identity by spoofing an IP address. However, he will have to put up with the server's response being relayed to the target host as well.

• Injecting the attacker's packet

Now that the attacker has interrupted the connection between the server and target, he can choose to either inject data into the network or actively participate as the "man in the middle", and pass data from the target to the server, and vice versa, reading and injecting data as he sees fit.

Session Fixation

SESSION FIXATION

Fig. SESSION FIXATION. Click to Enlarge

Session Fixation:

Whenever a visitor first visit a page in your application that calls session_start(), then a session is created for the user. PHP generates a random session identifier to identify the user (you can see this identifier by using session_id()) which is also known as session token, and then it sends a Set-Cookie header to the client. By default, the name of this cookie is PHPSESSID, but you can change the cookie name in php.ini or by using the session_name() function. On subsequent visits, the client identifies the user with the cookie, and this is how the application maintains state.

It is possible to set the session identifier manually through the query string, forcing the use of a particular session. This simple attack is called session fixation because the attacker fixes the session. This is most commonly achieved by creating a link to your application and appending the session identifier that the attacker wishes to give any user clicking the link.

<a href="http://yoursite.com/index.php?PHPSESSID=123456">Fix the session</a>


By clicking the above link an would be attacker could get access the protected user’s login credentials and so on. If the user logs in while using the provided session identifier, the attacker may be able to ride on the same session and gain access to the user’s account. This is why session fixation is sometimes referred to as session riding.

Session Hijacking - Introduction

Session hijacking is when a hacker takes control of a user session after the user has successfully authenticated with a server. Session hijacking involves an attack identifying the current session IDs of a client/server communication and taking over the client’s session. Session hijacking is made possible by tools that perform sequence numbers prediction.

Fig. SESSION HIJACKING . Click to Enlarge

SESSION HIJACKING - Detailed Explanation -How it Works?

Tools : Juggernaut, Hunt, TTY Watcher, IP Watcher, T-Sight

Download the session (8.1 MB) in MP3 format:

What is Session?

What is Session?

HTTP is known as a stateless protocol. which means that the webserver does not care multiple requests come from the same user. In other words you can say that HTTP don’t remember anything when the execution is finished. After a TCP/IP three-way handshake is completed, a session is created which is used to create a state in between requests even when they occur after weeks from each other.

Sessions are maintained by passing a unique session identifier between requests typically in a cookie (which usually resides in webserver’s file system). Session can also be passed in forms and query arguments. PHP handles sessions transparently through a combination of cookies and URL rewriting, when session.use_trans_sid is turned on in php.ini (it is off by default in PHP5) by generating a unique session ID and using it track a local data store (by default, a file in the system’s temporary directory in my case /tmp/) where session data is saved at the end of every request.

Caution: session_start() must be called before any output is sent to the browser, because it will try to set a cookie by sending a response header.

Session Security
Most of the other attacks like XSS, CSRF etc could be prevented by filtering input and escaping output, but session attacks cannot. Rather it is necessary to plan for them and identify potential problem areas of your application.

Two notorious forms of session attacks are session fixation and session hijacking.