How to set up your own session fixation attack in five simple steps:
Step 1
Find a forum that puts session IDs in the URLs for guest users.
Step 2
Put an image in your sig runs a script that logs the IP address and referrer of everyone who sees it.
Step 3
Find an IP address that has both URLs with session IDs on them (thus guest users) and URLs without session IDs (probably logged in, setting their session ID in a cookie).
Step 4
Set the session ID with a fake cookie or by adding it to the URL.
Step 5
If you're now logged in as them, it worked. If not, try attacking some other forum software.
Why did I write that? Because I'm sick of "PHP Programmers" and "Web developers" who aren't even smart enough to reset the session ID every time a user changes their credentials (i.e. logs in), yet they think they know a thing or two about security and like to go on about how this script is more secure than that script.
Damn fools.
