Hijacking ASP.NET Sessions

Posted by Ricardo Peres on ASP.net Weblogs See other posts from ASP.net Weblogs or by Ricardo Peres
Published on Fri, 18 Oct 2013 10:11:22 GMT Indexed on 2013/10/18 15:55 UTC
Read the original article Hit count: 272

Filed under:

ASP.NET

|

Web

|

.NET

So, you want to be able to access other user’s session state from the session id, right? Well, I don’t know if you should, but you definitely can do that! Smile

Here is an extension method for that purpose. It uses a bit of reflection, which means, it may not work with future versions of .NET (I tested it with .NET 4.0/4.5).

        1: public static class HttpApplicationExtensions

       2: {

       3:     private static readonly FieldInfo storeField = typeof(SessionStateModule).GetField("_store", BindingFlags.NonPublic | BindingFlags.Instance);

       4:  

       5:     public static ISessionStateItemCollection GetSessionById(this HttpApplication app, String sessionId)

       6:     {

       7:         var module = app.Modules["Session"] as SessionStateModule;

       8:  

       9:         if (module == null)

        {

            return (null);

        }

  

        var provider = storeField.GetValue(module) as SessionStateStoreProviderBase;

  

        if (provider == null)

        {

            return (null);

        }

  

        Boolean locked;

        TimeSpan lockAge;

        Object lockId;

        SessionStateActions actions;

  

        var data = provider.GetItem(HttpContext.Current, sessionId.Trim(), out locked, out lockAge, out lockId, out actions);

  

        if (data == null)

        {

            return (null);

        }

  

        return (data.Items);

    }

}

As you can see, it extends the HttpApplication class, that is because we need to access the modules collection, for the Session module.

Use with care!

Developer IT