TCP Session Hijacking

TCP guarantees delivery of data, and also guarantees that packets will be delivered in the same order in which they were sent. In order to guarantee that packets are delivered in the right order, TCP uses acknowledgement (ACK) packets and sequence numbers to create a “full duplex reliable stream connection between two endpoints”, with the endpoints referring to the communicating hosts. The connection between the client and the server begins with a 3-way handshake.

After the handshake, it is just a matter of sending packets and incrementing the sequence number to verify that the packets are getting sent and received. The goal of the TCP session hijacker is to create a state where the client and server are unable to exchange data; enabling him/her to forge acceptable packets for both ends, which mimic the real packets. Thus, the attacker is able to gain control of the session.