Update: Session Management Cheat Sheet - Broken "Session Fixation" Black Hat Resource Links

[rjacobs-CityOfWichita]

What is missing or needs to be updated?

The two links included under the Transport Layer Security section of the Session Management Cheat Sheet (which presumably provide examples and/or more detailed explanation) regarding Session Fixation attacks are broken. They're suppose to link to some Black Hat EU presentation slides. Instead when you open either of them, you receive an "Access Denied" response from media.blackhat.com.

The usage of an encrypted communication channel also protects the session against some session fixation attacks where the attacker is able to intercept and manipulate the web traffic to inject (or fix) the session ID on the victim's web browser (see here and here).

How should this be resolved?

I see two options

1. The links could be removed entirely.
2. The links could be replaced with an updated permalink to the intended slides or with alternative, but equivalent resource references.

Personally, I think Option 2 is more beneficial, especially as someone who was hoping to use the linked resources to better understand Session (Cookie) Fixation attacks.

[jmanico]

Session fixation is rather old school. I am happy to have these deleted. If you see a better reference we'll take it. Would you care to submit a PR for this either way?

[rjacobs-CityOfWichita]

Sure! 🙂

…

________________________________ From: Jim Manico ***@***.***> Sent: Friday, September 6, 2024 3:19 AM To: OWASP/CheatSheetSeries ***@***.***> Cc: Jacobs, Robin ***@***.***>; Author ***@***.***> Subject: Re: [OWASP/CheatSheetSeries] Update: Session Management Cheat Sheet - Broken "Session Fixation" Black Hat Resource Links (Issue #1481) CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Session fixation is rather old school. I am happy to have these deleted. If you see a better reference we'll take it. Would you care to submit a PR for this either way? — Reply to this email directly, view it on GitHub<#1481 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AKE5B6SP7NEBPNVUWN66IWTZVFQRBAVCNFSM6AAAAABNXIYXOOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMZTGUYDQMZRGQ>. You are receiving this because you authored the thread.Message ID: ***@***.***>