Session replay

Question

Hi, any article to get the idea of how to prevent session replay in asp.net webform 4.5 application. please suggest

Naimish Makwana · Answer

Hello Tahir, Please read below article. It has given basic understanding of Sessio replay and also provied solution to prevent them in .net webform. I thing this will help you. https://www.sitepoint.com/how-to-prevent-replay-attacks-on-your-website/ Thanks Naimish Makwana

Tuhin Paul · Answer

Hi Tahir, Session replay attacks can be prevented by implementing any of the concepts: Enable SSL encryption: Use SSL to encrypt the communication between the client and the server. This will prevent eavesdropping and replay attacks. Use ViewStateUserKey: ASP.NET provides a mechanism called ViewStateUserKey that ties the ViewState of a page to a specific user. This prevents an attacker from stealing the ViewState and replaying it for a different user. Use anti-forgery tokens: Anti-forgery tokens are generated on the server and included in the page. When the form is submitted, the server verifies that the token matches the expected value. This prevents replay attacks and cross-site request forgery (CSRF) attacks. Use session timeouts: Set a short session timeout period. This will limit the window of opportunity for an attacker to capture and replay a session. Use secure cookies: Cookies should be set with the secure flag to prevent them from being transmitted over an unencrypted connection.

Jignesh Kumar · Answer

Hi Tahir, Please find below link for article which will help you, https://www.vanstechelman.eu/content/cookie-replay-attacks-in-aspnet-when-using-forms-authentication

Naimish Makwana · Answer

Hello Tahir, Check this : https://stackoverflow.com/a/32516735/3054222 Thanks Naimish Makwana

Rijwan Ansari · Answer

https://www.c-sharpcorner.com/UploadFile/ajyadav123/session-fixation-vulnerability-detection-in-Asp-Net/

Rajeev Kumar · Answer

If a session is not properly terminated and destroyed on the application server, then the session is vulnerable to session hijacking. This means that even though the user clicked on the logout button, an attacker may continue working inside the authenticated session.Every authenticated session is identified by a unique session token. This session token is stored in a cookie in the browser. Because your browser submits this cookie to the server for every page that you request, the web application is able to identify you as a user and can give you access to all your data. However, if an attacker is able to obtain the value of this session token (through various methods which we don't discuss here) then the attacker also has access to your data in the application.

Tahir Ansari · Answer

i'm still confuse about session replay