TCP/IP Hijacking: Session Takeover Attacks Explained

TCP (Transmission Control Protocol) establishes reliable connections using a three-way handshake: the client sends a SYN packet, the server responds with SYN-ACK, and the client replies with ACK. Each side uses sequence numbers to track data in the conversation.

Sequence numbers are 32-bit values that identify each byte of data sent. They ensure data arrives in order and without gaps. The initial sequence number (ISN) is chosen when the connection begins, and each subsequent packet increments the sequence number by the amount of data sent.

Acknowledgment numbers tell the sender what data the receiver has successfully received. If the sender does not receive an acknowledgment within a timeout period, it retransmits the data. This reliability mechanism can be exploited in hijacking attacks.

TCP sessions maintain state information including the IP addresses, port numbers, sequence numbers, and acknowledgment numbers of both parties. An attacker who can predict or observe these values can insert themselves into or take over an existing session.

Session sniffing involves passively capturing network traffic to steal session tokens, cookies, or authentication credentials. On unencrypted connections, these values are transmitted in plaintext and can be immediately reused by an attacker.

Sequence number prediction attacks attempt to guess the ISN of a TCP connection to inject forged packets. Modern operating systems use randomized ISNs, making this attack more difficult than it was historically, but weak implementations still exist.

Man-in-the-middle session hijacking combines ARP poisoning with TCP session manipulation. The attacker positions themselves between the client and server, forwarding traffic while selectively modifying packets or injecting commands into the session.

Session sidejacking (also called session hijacking via cookie theft) captures session cookies transmitted over unencrypted connections. The attacker then uses these cookies in their own browser to impersonate the victim. This was demonstrated by the Firesheep tool.

The attacker first monitors the target connection to determine the current sequence and acknowledgment numbers. This can be done through network sniffing on the same network segment or through a man-in-the-middle position.

Next, the attacker crafts a packet with the correct source IP, destination IP, source port, destination port, and sequence number to match the legitimate session. This spoofed packet appears to the server as a continuation of the real client's conversation.

To prevent the real client from disrupting the hijacked session, the attacker may flood the client with RST packets or launch a denial-of-service attack. This desynchronizes the original connection, leaving the attacker as the only active participant.

The attacker can now send commands to the server as if they were the authenticated user. This might involve executing system commands on an SSH session, making transactions on a web application, or exfiltrating data through the established connection.

End-to-end encryption (TLS/SSL) is the most effective defense. When traffic is encrypted, an attacker cannot read session tokens or sequence numbers, making hijacking practically impossible even with a man-in-the-middle position.

Implement secure session management in web applications: use HttpOnly and Secure flags on cookies, regenerate session IDs after authentication, implement session timeouts, and bind sessions to IP addresses and browser fingerprints.

Use IPsec to authenticate and encrypt IP-level communications, preventing packet spoofing and injection. IPsec verifies that packets come from legitimate sources and have not been modified in transit.

Deploy network security measures including switch port security, DHCP snooping, and Dynamic ARP Inspection to prevent the man-in-the-middle positioning that many hijacking attacks require. Monitor for suspicious TCP RST floods that may indicate hijacking attempts.