What is the primary goal of session hijacking attacks?

Question

Options

• ATo steal credentials through phishing
• BTo take control of an active session between a user and a server
• CTo perform vulnerability scans on the network
• DTo disrupt communication between network devices

• A
  3% (1)
• B
  88% (30)
• C
  6% (2)
• D
  3% (1)

Explanation

Session hijacking targets an already-authenticated session token, allowing an attacker to impersonate a legitimate user without needing their credentials - making B correct. The attacker essentially "steals the ticket" after the user has already logged in, bypassing the authentication step entirely.

• A is wrong because phishing steals credentials before authentication - it's a separate attack category aimed at obtaining usernames and passwords, not hijacking an existing session.
• C is wrong because vulnerability scanning is a reconnaissance technique, not an attack that targets user sessions or authentication state.
• D is wrong because disrupting communication describes a Denial of Service (DoS) or network-layer attack, not session exploitation.

Memory tip: Think of session hijacking like stealing someone's boarding pass after they've already checked in - you skip the ID check entirely and just walk through as them. The key word "active" in option B is the giveaway: hijacking requires an existing session, not credential theft or network disruption.

No community discussion yet for this question.