CyberGlossary

Attacks & Threats

Session Hijacking

Also known as: TCP session hijacking, Cookie session hijacking

Definition

An attack that takes over a victim's authenticated session by stealing or forging the session identifier so the attacker can act as the user without their credentials.

Session hijacking targets the token used to maintain an authenticated session — typically a cookie or bearer token — and reuses it from an attacker-controlled client. Tokens can be captured through network sniffing on unencrypted links, XSS exfiltration, malware on the client, predictable session ID generation, session fixation, or cookie/token theft from third parties. Once the session is replayed, the attacker bypasses authentication, including MFA performed earlier. Defences include HTTPS everywhere with HSTS, secure cookie flags (Secure, HttpOnly, SameSite), strong CSPs against XSS, short-lived rotated tokens, device-bound tokens (DPoP, Token Binding, passkeys), continuous risk-based reauthentication, and detection of session anomalies (IP, device fingerprint, ASN).

Examples

  • An XSS payload exfiltrates a logged-in user's session cookie to the attacker, who pastes it into their browser to impersonate the victim.
  • Malware on a workstation steals an OAuth refresh token, granting persistent access to a SaaS application.

Related terms