<h3 id="heading-login-screen">Login Screen</h3>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1692214494724/4977d96b-e0b4-47ae-b741-504736374439.png" alt class="image--center mx-auto" /></p>
<h3 id="heading-login-attempt-request">Login Attempt Request</h3>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1692214497798/7209ec02-ca0a-47a8-a29a-c039381a3f63.png" alt class="image--center mx-auto" /></p>
<h3 id="heading-login-complete">Login Complete</h3>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1692214499794/5a27092c-b257-4ff8-8bda-8a953da500b3.png" alt class="image--center mx-auto" /></p>
<p>The above website issues a session before login and verifies the ID and password received during the login attempt request.</p>
<p>In other words, the website follows this flow: Issuing a session ID (unauthenticated) → Login authentication → Using the authenticated session ID. Therefore, it is possible to bypass the login process.</p>
<h3 id="heading-fake-login-attempt">Fake Login Attempt</h3>
<p><img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1692214502639/9f002c4d-3a45-4aeb-8754-66b1ee8ba4fa.png" alt class="image--center mx-auto" /></p>
<p>By using Burp Suite's Repeater, the ID is changed to "admin" in the request and sent. Naturally, the response will be "fail," but since the user ID on the server-side has already been changed during the authentication process, and the session ID is already authenticated, resending the request from the "Login Complete" state will result in being logged in and the ID will be changed.</p>


### Login Screen

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692214494724/4977d96b-e0b4-47ae-b741-504736374439.png align="center")

### Login Attempt Request

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692214497798/7209ec02-ca0a-47a8-a29a-c039381a3f63.png align="center")

### Login Complete

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692214499794/5a27092c-b257-4ff8-8bda-8a953da500b3.png align="center")

The above website issues a session before login and verifies the ID and password received during the login attempt request.

In other words, the website follows this flow: Issuing a session ID (unauthenticated) → Login authentication → Using the authenticated session ID. Therefore, it is possible to bypass the login process.

### Fake Login Attempt

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1692214502639/9f002c4d-3a45-4aeb-8754-66b1ee8ba4fa.png align="center")

By using Burp Suite's Repeater, the ID is changed to "admin" in the request and sent. Naturally, the response will be "fail," but since the user ID on the server-side has already been changed during the authentication process, and the session ID is already authenticated, resending the request from the "Login Complete" state will result in being logged in and the ID will be changed.

Web Hacking Practice: Session Fixation Attack

Login Screen

Login Attempt Request

Login Complete

Fake Login Attempt