Session hijack is taking over a valid login session so an attacker can act as another user without knowing the password. The attacker reuses the victim’s session token, cookie, or other authentication state that the application already trusts.
This matters because many systems treat an active session as proof of identity. If session handling is weak, stolen tokens, predictable IDs, cross-site scripting, or leaked logs can let an intruder bypass login controls and move straight into sensitive functions. Defenders reduce the risk by using secure cookies, short session lifetimes, token rotation after login, strong transport encryption, and monitoring for unusual session reuse or impossible travel. In real intrusions, session hijack often becomes the first step to data theft, account abuse, or deeper compromise inside web applications and helpdesk platforms.