I'm reviewing some IIS logs for a Classic ASP website.
Normally, I see one session ID per request in the log file, eg:
YYYY-MM-DD HH:MM:SS W3SVCXXXXXXX SERVERNAME IP URLPATH SOURCE IP COOKIE
And as part of the cookie data is the session id, eg,
This all looks normal to me.
Recently, I've noticed 1 IP address making many requests with 90 ASPSESSIONID key value pairs in the cookie data...
This is the first time I have seen this. Can anyone tell me:
1) Is this normal behaviour for classic ASP and session IDs?
2) Should this be considered a hacking attempt?
As the session state is resolved via the cookie ID, it looks like someone trying to spoof a cookie value in an attempt to hijack an existing cookie value to gain access to member's areas etc...
Does this sound correct? Am I reading the logs correctly?
Your input is appreciated.