Scribd
Upload
13 views

Failure to Invalidate session - on logout - Client side Server side - Without Burp

The document describes a vulnerability in an application where user sessions are not invalidated upon logout, allowing for potential session hijacking. An attacker could exploit this by changing a user's password and locking them out. The impact includes reputational damage and financial loss due to perceived insecurity by customers.

Uploaded by

piyushcyber9
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
13 views

Failure to Invalidate session - on logout - Client side Server side - Without Burp

The document describes a vulnerability in an application where user sessions are not invalidated upon logout, allowing for potential session hijacking. An attacker could exploit this by changing a user's password and locking them out. The impact includes reputational damage and financial loss due to perceived insecurity by customers.

Uploaded by

piyushcyber9
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

Vulnerability - Broken authentication and session management-failure to invalidate

session on logout (client-side/server-side)


-----------------------------------------------------------------------------------
-----------------------------------------------------------

Description - This application fails to invalidate a user’s session on logout,


leaving the account vulnerable to session hijacking. An attacker may compromise a
user’s session then be able to change the password of the account and lock out the
legitimate user.
-----------------------------------------------------------------------------------
-----------------------------------------------------------

Steps -
1 - Go to the URL - https://www.target.com
2 - Open the same account on two different tabs on the same browser - Broswer A
3 - Click on the Logout from one tab - TAB A
4 - Once the session is terminated, go to the second tab (TAB B) and update some
data and save it
5 - Post changing the data, click on the refresh button.
6 - Once refreshed, your second tab session is also terminated.
7 - Login again to the same account and the data has been changed
-----------------------------------------------------------------------------------
-----------------------------------------------------------

Impact - This vulnerability can lead to reputational damage and indirect financial
loss to the company as customers may view the application as insecure.
-----------------------------------------------------------------------------------
-----------------------------------------------------------

You might also like