Session Hijacking over HTTP

[11ack3r <11ack3r () gmail com>]

Hello Everyone,

I was curious to know how would webmail portals like gmail.com and
yahoo.com protect their users from session hijacking when they use
HTTP after authentication.

As I see it is trivial to capture traffic over the wire including
session cookies. In such a case can an attacker just reuse the session
cookies in his/her browser and compromise the user account?

WHat is the best way to protect session cookies from hijacking esp.
due to network eavesdropping? Of course HTTPS can also be bypassed
with MITM attacks if users ignore browser warnings.

Looking forward to some knowledge here.

Cheers!!

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------