Lab: Session Hijacking

← EHE
Lab Exercise
Session Hijacking: Token Analysis & Exploitation
SCORE 100
0 /8 objectives
! WARNING
This lab is a simulated environment for educational purposes only. All IP addresses, session tokens, and user data are fictional. Session hijacking against real systems without written authorization is a federal crime under the CFAA.
Lab Complete — Session Hijacked
All 8 objectives completed. Final score: 100 pts.
[ ]1: Capture
[ ]2: Analysis
[ ]3: Prediction
[ ]4: Hijacking
[ ]5: ZAP
Session Hijacking Lab — Phase 1: HTTP Traffic Capture
Intercepted HTTP Traffic — Victim (10.0.1.50) ↔ Web Server (10.0.1.10)

The left panel shows 10 intercepted HTTP exchanges. Click any item to inspect the full request/response headers. Look for Set-Cookie headers — they contain the session tokens.
► Select a request to begin.

Use the analysis tools below to dissect the captured session tokens and identify the vulnerability.

Token Inspector

Paste a captured session ID to view its structural breakdown.

Sequence Analyzer

Analyze all captured tokens to identify the generation pattern.

Token Entropy Calculator

Measure the randomness (entropy) of the session token space.

Based on your analysis, the session tokens follow a sequential timestamp pattern. The last known active session is SESS_1708234010 (victim jpark logged in). Predict the next valid session ID that would be assigned to a new login.

Session ID Predictor

Enter your predicted next session token (format: SESS_XXXXXXXXXX):

Token Timeline
SESS_1708234001
SESS_1708234002
SESS_1708234003
…
SESS_1708234009
SESS_1708234010 (victim)
SESS_????????
Tokens highlighted in yellow = captured. Red = victim's active session. Purple = your prediction target.

You have a predicted session token. Now send a crafted HTTP request to the server using that token in the Cookie header. If the token is valid, you will be authenticated as the victim.

Simulated curl Request
curl -H "Cookie: PHPSESSID=SESS_1708234011" \ -v \ http://10.0.1.10/dashboard

Use OWASP ZAP (simulated) to perform an automated session management analysis against the target web application. ZAP will detect misconfigurations and generate a findings report.

OWASP ZAP — Session Analysis Scanner
Target: http://10.0.1.10/  |  Spider: Complete  |  Active Scan: Session Management
Risk Finding Evidence