WEB安全漏洞之会话标识未更新漏洞（.net强制更新会话标识）

fengxingke

已于 2022-07-29 14:36:06 修改

阅读量678

点赞数 1

分类专栏：分享类文章标签： web安全安全 .net 会话标识

于 2022-07-27 17:55:31 首次发布

本文链接：https://blog.csdn.net/yinshengchen/article/details/126020092

版权

分享类专栏收录该内容

38 篇文章 2 订阅

订阅专栏

在登录成功后，强制更新会话标识：

注意，调用ChangeSessionID()方法更新会话标识后，SessionID并不会立即更新，要在下次发起请求时，才可以通过“System.Web.HttpContext.Current.Session.SessionID;”看到SessionID为变为了更新后的会话ID。

        #region 更新会话标识
        /// <summary>
        /// 更新sessionId
        /// </summary>
        public static void ChangeSessionID()
        {
            HttpContext Context = HttpContext.Current;
            System.Web.SessionState.SessionIDManager manager = new System.Web.SessionState.SessionIDManager();
            string oldId = manager.GetSessionID(Context);
            string newId = manager.CreateSessionID(Context);
            bool isAdd = false, isRedir = false;
            manager.SaveSessionID(Context, newId, out isRedir, out isAdd);
            HttpApplication ctx = (HttpApplication)HttpContext.Current.ApplicationInstance;
            HttpModuleCollection mods = ctx.Modules;
            System.Web.SessionState.SessionStateModule ssm = (SessionStateModule)mods.Get("Session");
            System.Reflection.FieldInfo[] fields = ssm.GetType().GetFields(BindingFlags.NonPublic | BindingFlags.Instance);
            SessionStateStoreProviderBase store = null;
            System.Reflection.FieldInfo rqIdField = null, rqLockIdField = null, rqStateNotFoundField = null;
            foreach (System.Reflection.FieldInfo field in fields)
            {
                if (field.Name.Equals("_store")) store = (SessionStateStoreProviderBase)field.GetValue(ssm);
                if (field.Name.Equals("_rqId")) rqIdField = field;
                if (field.Name.Equals("_rqLockId")) rqLockIdField = field;
                if (field.Name.Equals("_rqSessionStateNotFound")) rqStateNotFoundField = field;
            }
            object lockId = rqLockIdField.GetValue(ssm);
            if ((lockId != null) && (oldId != null)) store.ReleaseItemExclusive(Context, oldId, lockId);
            rqStateNotFoundField.SetValue(ssm, true);
            rqIdField.SetValue(ssm, newId);
        }

        #endregion

参考博文：WEB安全漏洞之会话标识未更新漏洞_艾苟尼的博客-CSDN博客_会话标识未更新漏洞