Alright I'm trying to test session fixation/hijacking on my localhost.
I'm trying to give my URL with SID from the attacker to the victim and let victim login in that URL. But when the victim login, the attacker refreshed the page and still in the login page.
Then I discovered that if I have two login tabs in a browser, victim login in Tab 1 but Tab 2 doesn't auto login after refreshing. So that's probably why my attacker stay on the login page ?
My question is that what do I have to do in my php files to auto login the user in the other tabs if he has already login in one tab? What keyword should I look up to for this kind of case ?
0 comments:
Post a Comment