# What is Session Hijacking?

> Session hijacking is the takeover of an authenticated session — typically by stealing or replaying its token or cookie — so the attacker inherits the victim’s access without performing a login.

- Canonical URL: https://yellowcube.eu/glossary/session-hijacking/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Because the session artifact is the proof of identity after sign-in, possessing it bypasses even strong authentication. Theft paths include cross-site scripting, malware reading browser storage, adversary-in-the-middle relays, token leakage through logs or referrers, side-jacking on unencrypted channels, and fixation where the attacker plants the session identifier.

Defense works at two layers: make tokens hard to steal, and make stolen tokens useless fast. Secure cookie attributes, transport protection, token binding to client context where feasible, short lifetimes, rotation on privilege change, anomaly detection on session properties, and real revocation all narrow the window.

### Key points

- **Theft vectors:** Cross-site scripting, malicious or vulnerable extensions, endpoint malware, proxied phishing, referrer and log leakage, and interception where transport protection is absent.
- **Mitigation:** `Secure`, `HttpOnly`, and appropriately scoped cookies; full transport encryption; token binding and rotation; short idle and absolute lifetimes; re-authentication for sensitive actions.
- **Detection and response:** Alert on session anomalies such as client, location, or fingerprint changes; provide working revocation; invalidate sessions on credential reset and on suspicion of theft.
- **Important limitation:** Correctly configured cookies do not stop theft by malware or XSS on the endpoint, and long-lived sessions leave a wide abuse window even when transport is encrypted. Revocation that does not reach every issuing and consuming service is no revocation.

### Related terms

[Session management](<https://yellowcube.eu/glossary/session-management/>) · [Authentication token](<https://yellowcube.eu/glossary/authentication-token/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Adversary-in-the-middle (AiTM) phishing](<https://yellowcube.eu/glossary/adversary-in-the-middle-phishing/>) · [Cross-site scripting (XSS)](<https://yellowcube.eu/glossary/cross-site-scripting/>)

### Sources

[OWASP, Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) · [MITRE ATT&CK T1539: Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/) · [MITRE ATT&CK T1550: Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.