Which of the following refers to the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system?

Question

Options

• ASpoofing
• BSmurf
• CSession hijacking
• DPhishing

• A
  7% (3)
• B
  2% (1)
• C
  86% (36)
• D
  5% (2)

Explanation

Session hijacking (C) involves an attacker taking over an already-authenticated session between a user and a server - exploiting the valid session token to impersonate the user and gain unauthorized access without needing credentials.

Why the others are wrong:

• A. Spoofing is about faking an identity (IP address, email sender, MAC address) to appear as a trusted source - it's about impersonation, not session takeover.
• B. Smurf is a DDoS amplification attack that floods a victim with ICMP echo replies - it's about disrupting availability, not stealing sessions.
• D. Phishing is a social engineering attack that tricks users into revealing credentials via fake websites or emails - it targets humans, not live sessions.

Memory tip: Think of hijacking literally - a hijacker takes control of something already in motion (a plane, a car). Session hijacking takes control of a connection already in progress, after authentication has already occurred.

No community discussion yet for this question.