Secure Session Management: Preventing Session Hijacking

# Secure session token generation
import secrets
import hashlib
from datetime import datetime, timedelta

def generate_session_token():
    """Generate cryptographically secure session token."""
    # Use cryptographically secure random
    random_bytes = secrets.token_bytes(32)
    token = secrets.token_urlsafe(32)
    
    # Add timestamp for uniqueness
    timestamp = datetime.utcnow().isoformat()
    combined = f"{token}:{timestamp}"
    
    # Hash for additional security
    token_hash = hashlib.sha256(combined.encode()).hexdigest()
    
    return f"{token}:{token_hash[:16]}"

def validate_session_token(token, stored_token):
    """Validate session token."""
    # Constant-time comparison to prevent timing attacks
    return secrets.compare_digest(token, stored_token)

# Secure session storage
import redis
from datetime import timedelta

redis_client = redis.Redis(host='localhost', port=6379, db=0)

def create_session(user_id):
    """Create secure session."""
    token = generate_session_token()
    
    # Store session data
    session_data = {
        'user_id': user_id,
        'created_at': datetime.utcnow().isoformat(),
        'last_activity': datetime.utcnow().isoformat(),
        'ip_address': request.remote_addr,
        'user_agent': request.headers.get('User-Agent')
    }
    
    # Store with expiration
    redis_client.setex(
        f"session:{token}",
        timedelta(hours=24),
        json.dumps(session_data)
    )
    
    return token

def validate_session(token, ip_address, user_agent):
    """Validate session with security checks."""
    session_data = redis_client.get(f"session:{token}")
    
    if not session_data:
        return None
    
    session = json.loads(session_data)
    
    # Check IP address (optional, can be strict or lenient)
    if session.get('ip_address') != ip_address:
        # Log suspicious activity
        log_suspicious_activity(token, 'ip_mismatch')
        # Optionally invalidate session
        # return None
    
    # Check user agent
    if session.get('user_agent') != user_agent:
        log_suspicious_activity(token, 'user_agent_mismatch')
    
    # Update last activity
    session['last_activity'] = datetime.utcnow().isoformat()
    redis_client.setex(
        f"session:{token}",
        timedelta(hours=24),
        json.dumps(session)
    )
    
    return session

def login_user(username, password, existing_session_token=None):
    """Login user with session fixation prevention."""
    # Validate credentials
    user = authenticate(username, password)
    
    if not user:
        return None
    
    # Regenerate session token on login (prevent fixation)
    if existing_session_token:
        # Invalidate old session
        redis_client.delete(f"session:{existing_session_token}")
    
    # Create new session
    new_token = create_session(user.id)
    
    return new_token

# src/session_hijacking_demo.py
"""Educational demonstration of session hijacking attacks."""
from flask import Flask, request, make_response, session
import json

app = Flask(__name__)
app.secret_key = 'demo-secret-key'

# Vulnerable session implementation
@app.route('/login', methods=['POST'])
def vulnerable_login():
    """Vulnerable login that doesn't regenerate session."""
    username = request.form.get('username')
    password = request.form.get('password')
    
    if authenticate(username, password):
        # VULNERABLE: Uses existing session ID
        session['user_id'] = get_user_id(username)
        session['authenticated'] = True
        return "Login successful"
    
    return "Login failed", 401

@app.route('/steal-session', methods=['GET'])
def steal_session_demo():
    """Demonstrate session token theft via XSS."""
    # This would be injected via XSS
    stolen_token = request.args.get('token')
    
    # Attacker could use this token to hijack session
    # In real attack, this would be sent to attacker's server
    return f"Stolen token: {stolen_token}"

# Secure session implementation
def secure_login(username, password):
    """Secure login with session regeneration."""
    if authenticate(username, password):
        # SECURE: Regenerate session ID
        session.clear()  # Clear old session
        session.regenerate()  # Generate new ID
        session['user_id'] = get_user_id(username)
        session['authenticated'] = True
        return True
    return False

# Session cloning demonstration
def demonstrate_session_cloning():
    """Show how session cloning works."""
    # Attacker steals session cookie
    stolen_cookie = "session_id=abc123"
    
    # Attacker uses cookie in their browser
    # Browser sends cookie with requests
    # Server accepts cookie as valid
    # Attacker gains access
    
    # Prevention: Bind session to IP, user agent, or use token binding

# Token replay demonstration
def demonstrate_token_replay():
    """Show token replay attacks."""
    # Attacker captures valid token
    captured_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    
    # Attacker replays token later
    # If token not expired, access granted
    # If no replay protection, attack succeeds
    
    # Prevention: Use nonces, one-time tokens, or short expiration

# src/password_manager_attacks.py
"""Educational demonstration of password manager attacks."""
import psutil
import pyperclip
import json
from pathlib import Path

class PasswordManagerAttacks:
    """Demonstrates password manager attack vectors."""
    
    def memory_scraping_demo(self):
        """Demonstrate memory scraping attacks."""
        # Password managers store decrypted passwords in memory
        # Attackers can dump process memory to extract passwords
        
        process_name = "password-manager"
        for proc in psutil.process_iter(['pid', 'name']):
            if process_name in proc.info['name'].lower():
                # Dump process memory (requires admin)
                # Extract passwords from memory dump
                # This is why password managers use secure memory
                pass
    
    def clipboard_hijack_demo(self):
        """Demonstrate clipboard hijacking."""
        # Password managers copy passwords to clipboard
        # Malicious software can monitor clipboard
        
        import time
        
        # Monitor clipboard
        last_clipboard = ""
        while True:
            current_clipboard = pyperclip.paste()
            if current_clipboard != last_clipboard:
                # Password detected in clipboard
                print(f"Clipboard changed: {current_clipboard[:20]}...")
                # Attacker could exfiltrate this
                last_clipboard = current_clipboard
            time.sleep(0.1)
    
    def browser_stealer_demo(self):
        """Demonstrate browser data extraction."""
        # Password managers store data in browser storage
        # Malicious extensions or malware can extract data
        
        # Browser storage locations
        chrome_storage = Path.home() / "Library/Application Support/Google/Chrome"
        firefox_storage = Path.home() / "Library/Application Support/Firefox"
        
        # Extract stored passwords (requires decryption)
        # This is why password managers encrypt storage
    
    def defense_mechanisms(self):
        """Show defense mechanisms."""
        defenses = {
            "memory_protection": "Use secure memory, clear after use",
            "clipboard_clearing": "Auto-clear clipboard after timeout",
            "encrypted_storage": "Encrypt all stored passwords",
            "master_password": "Require master password for access",
            "two_factor": "Add 2FA for additional security"
        }
        return defenses