Account & Session Attacks

Cookie theft is when attackers steal session cookies from a browser to impersonate a user and access accounts without the password.

Credential stuffing is when attackers use leaked username/password pairs to automatically try logins across many sites until one works.

Man-in-the-browser (MitB) attacks use malware or malicious extensions to manipulate what a user sees in the browser and to steal data from inside sessions.

Session fixation is when an attacker forces a victim to use a session identifier the attacker already knows, then takes over that session after the victim authenticates.

Session hijacking is when an attacker steals or reuses a valid session cookie/token to act as the user without needing the password again.