Java EE (Java Enterprise Edition) General Discussion

hello dude,

I just want to avoid session hijacking for my current developing project to make it more secured and have gone through the concept by googling. But to me, some points are unclear. for example,

1 How can the jacker deploy his code into my jsp file to get the session id and other session details?
2 Will he use some tool to get my session id ?


( I will be admired and understood better, if someone can give sample code for this)