CAPEC-60Reusing Session IDs (aka Session Replay)

This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay. Metadata: detailed CAPEC pattern, status draft, likelihood high, severity high. Underlying weaknesses: CWE-294, CWE-290, CWE-346, CWE-384, CWE-488 (and 5 more). Mapped ATT&CK techniques: [object Object], [object Object]. Related CAPEC pattern: [object Object].