4 min read

Topic 20 of 24

Network Attacks and Session Attacks

Network attacks are malicious activities performed over a network to intercept, disrupt, or modify data communication between a client and server.

🌐 Network Attacks and Session Attacks (Web Engineering)

📌 1. Definition

🌐 Network Attacks

Network attacks are malicious activities performed over a network to intercept, disrupt, or modify data communication between a client and server.

🔐 Session Attacks

Session attacks are attacks that target a user’s session information (Session ID, cookies, tokens) to hijack or impersonate a legitimate user.

🌐 2. Network Attacks

🧠 2.1 Overview

Network attacks target the communication channel between:

Browser (client)
Server

⚠️ 2.2 Types of Network Attacks

1. 🕵️‍♂️ Man-in-the-Middle (MITM) Attack

📌 Definition

An attacker secretly intercepts communication between two parties.

🔑 How it works:

Attacker sits between user and server
Reads or modifies data

📈 Example:

Stealing login credentials on public Wi-Fi

2. 📡 Packet Sniffing

📌 Definition

Capturing data packets traveling over a network.

🔑 Example tools:

Wireshark (used for analysis, but can be misused)

3. 🔁 Replay Attack

📌 Definition

Attacker re-sends valid data packets to repeat unauthorized actions.

📈 Example:

Reusing login request packets

4. 🌊 Denial of Service (DoS/DDoS)

📌 Definition

Overloading a server with traffic to make it unavailable.

🔑 Types:

DoS → single source
DDoS → multiple sources

5. 🧨 DNS Spoofing

📌 Definition

Redirecting users to a fake website by modifying DNS records.

🔐 3. Session Attacks

🧠 3.1 Overview

Session attacks target the session management system used in web applications.

👉 Sessions are used to maintain user login state.

⚠️ 3.2 Types of Session Attacks

1. 🍪 Session Hijacking

📌 Definition

Stealing a user's session ID to gain unauthorized access.

🔑 Example:

Attacker logs into victim’s account without password

2. 🎯 Session Fixation

📌 Definition

Attacker forces a user to use a predefined session ID.

🔑 Process:

Attacker sets session ID
User logs in using that session
Attacker reuses session

3. 🕵️ Session Sniffing

📌 Definition

Intercepting session cookies using insecure networks.

4. 💣 Cross-Site Request Forgery (CSRF)

📌 Definition

Forcing a logged-in user to perform unauthorized actions.

📈 Example:

Transferring money without user consent

📊 4. Network vs Session Attacks

Feature	Network Attacks 🌐	Session Attacks 🔐
Target	Communication channel	User session data
Focus	Data transfer	Authentication
Example	MITM, DoS	Hijacking, CSRF
Level	Network layer	Application layer

🧩 5. Attack Flow Diagram

User → Network → Server
      ↘ Attacker intercepts ↙
   (Data / Session Theft)

🛡️ 6. Prevention Techniques

🔐 For Network Attacks

✔ Use HTTPS (SSL/TLS encryption) ✔ Firewalls and intrusion detection systems ✔ Secure Wi-Fi networks ✔ Encryption of data packets

🔐 For Session Attacks

✔ Use strong session IDs ✔ Session expiration (timeout) ✔ Regenerate session ID after login ✔ Use secure cookies (HttpOnly, Secure) ✔ Implement CSRF tokens

📈 7. Importance in Web Security

Protects user data
Prevents unauthorized access
Ensures secure communication
Maintains trust in web applications

⚠️ 8. Important Exam Points

✔ Network attacks target data transmission ✔ Session attacks target user authentication state ✔ HTTPS reduces network attacks ✔ Secure session management reduces session attacks