replay attack

replay attack

need access to the raw network dat by netowrk tap, arp poisoning, malwar eon victim computer to replay back to server acting as the victime computer

is the replay an on path attack

no the replay itself is not but its common to do an on path attack to gather details for the later replay attack

pass the hash

attacker captures hashes password from victim and replays into the server posing as the og client

how to stop pass the hash

use a salt or encryption

browser cookies

sotre info by the browser on computer

used for tracking, personalization, session managemnet

can be a privacy risk

s

session ids are stored where

cookies

how can an attacker use session ids

gains access to a server withotu needing any lgoin detailes

session hijackign or sidejacking

attacker gain access to session id to access server without login details

where are session ids stored

headers that are sent back and forth between systems

header manipulation

headers are also exploits that can gather details ona client machine and sent it to an attacker

modify headers

modify cookies

gather info

how to prevent session hijacking

encrypt end to end so they cant see session id