312-49 · Question #481
Attacker uses vulnerabilities in the authentication or session management functions such as exposed accounts, session IDs, logout, password management, timeouts, remember me. secret question…
The correct answer is B. Timeout Exploitation. This scenario describes Timeout Exploitation. When a session does not have a proper inactivity timeout and the user does not explicitly log out, the authenticated session remains active. An attacker who gains access to the same browser can hijack the live session without…
Question
Attacker uses vulnerabilities in the authentication or session management functions such as exposed accounts, session IDs, logout, password management, timeouts, remember me. secret question, account update etc. to impersonate users, if a user simply closes the browser without logging out from sites accessed through a public computer, attacker can use the same browser later and exploit the user's privileges. Which of the following vulnerability/exploitation is referred above?
Options
- ASession ID in URLs
- BTimeout Exploitation
- CI/O exploitation
- DPassword Exploitation
How the community answered
(44 responses)- A5% (2)
- B93% (41)
- C2% (1)
Explanation
This scenario describes Timeout Exploitation. When a session does not have a proper inactivity timeout and the user does not explicitly log out, the authenticated session remains active. An attacker who gains access to the same browser can hijack the live session without needing credentials. This falls under broken authentication and session management vulnerabilities (OWASP). 'Session ID in URLs' refers to leaking session tokens via browser history or referrer headers; it is a separate issue. The correct classification here is timeout/session expiry exploitation.
Topics
Community Discussion
No community discussion yet for this question.