Exploiting a potential ASP.NET web app Session Fixation vulnerability

I am pen-testing an ASP.NET application that is exhibiting Session Fixation behavior. The application is using cookie based sessions. Basically:

1. When you land on the page no Session cookie is created


2. After login ASP.NET_SessionId cookie is created


3. On logout and repeated login the cookie value remains the same (there is no cookie value regeneration)

I have been able to perform Session Fixation attack manually:

1. I have landed on the page


2. I manually created a ASP.NET_SessionId cookie with some value (for the attacker)


3. I opened a new browser session and set the exact same cookie (for the victim)


4. I logged in as victim in this new browser session


5. In the attacker’s browser session I was now able to browse the web site as the victim

I am now having problems exploiting this Session Fixation vulnerability in real conditions. I need to create or modify ASP.NET_SessionId cookie in some manner. From what I am able to tell, there is no XSS vulnerability on the web site which I could use.

I have been playing with two most notable attack variations but with no luck (a case where a victim would click on a link which would set a cookie on the web page):

• JavaScript

http://ift.tt/1LHnxdY'ASP.NET_SessionId=THISISAFIXATEDCOOKIE; expires=Thu, 18 Dec 2015 12:00:00 UTC; path=/; domain=example.com; path=/'</script>

• HTML Injection

http://ift.tt/1AuxY2S http-equiv=Set-Cookie content="ASP.NET_SessionId=THISISAFIXATEDCOOKIE; expires=Thu, 18 Dec 2015 12:00:00 UTC; path=/; domain=example.com; path=/">

Whatever I tried I’ve either hit a default error page or the landing page with no created/modified cookie.

Am I missing something with these two attack vectors?

Is there any other method I could try in creating or modifying the victim’s ASP.NET_SessionId cookie besides using man-in-the-middle or man-in-the-browser (malware based) attacks?