Learn in the textbookAttacks on Networks and Communication Paths
DefinitionSession hijacking (セッションハイジャック) is an attack in which the attacker steals the information that identifies the continuing exchange after login, the session (セッション), and takes over that communication by posing as the user.
ExplanationA web service issues each logged-in user an identifying value called a session ID (セッションID) and passes it back and forth in a cookie (a small piece of data a site has the browser store) or similar, to confirm the user is logged in. If an attacker obtains this value by eavesdropping, guessing, or extracting it with a script, they can act as the user without knowing the password.
AnalogyIt is like stealing the wristband an amusement park puts on you at the gate: with it, someone can ride the attractions as you without buying a ticket. The staff let people through by looking at the wristband alone.
Memory hook"Hijack" is the same word used for seizing a plane or a car; here the thing seized is the session.