Forum Discussion

SanYang's avatar
SanYang
Icon for Cirrus rankCirrus
Aug 31, 2023

About Session Hijacking

Hello, I've been testing session hijacking lately. Here is my setting I have found that when I change SESSION or TS01340bfb individually, F5 blocks it. However, when I change bo...
application delivery
Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP

Funny, I came across the same issue recently in a customer scenario. Nikoolayy1 is correct.
Here are my 5 cents.
1. Steal one cookie > ASM will block.
2. Steal both cookies > ASM won't block this, Session Hijacking is possible.
3. Enable a Bot Defense profile for this VS and configure it to create a Device ID.
4. Configure the following in the learning and blocking settings:

This way hijacking the session by stealing both cookies will fail.

KR
Daniel

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Sep 05, 2023

Also APM can be added so that each device to be checked if it is corporate https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-0-0/15.html  , using the APM checks. Even if someone steals even the APM cookie after some time their device will be checked.

 

Setting up ASM session tracking with APM

You can use session tracking to track, enforce, and report on user sessions and IP addresses. To perform tracking, you enable session awareness and indicate how to associate the application user name with the session.
  1. On the Main tab, click Security > Application Security > Sessions and Logins > Session Tracking .
    The Session Tracking screen opens.
  2. In the Session Tracking Configuration area, select the Session Awareness check box.
  3. From the Application Username list, select Use APM Usernames and Session ID.
  4.