Bob is going to perform an active session hijack against Brownies Inc. He has found a target that allows session oriented connections (Telnet) and performs the sequence prediction on the target…

Taking over the session is the final goal, but it cannot happen until the attacker has determined the correct sequence numbers to forge valid packets.

Reverse sequence prediction is not a standard step in the session hijacking process; the attacker moves forward by guessing numbers, not reversing them.

TCP session hijacking requires the attacker to inject packets that the target host will accept as legitimate. To do this, the attacker must predict or guess the correct sequence number in the TCP stream at that moment. Without a valid sequence number, injected packets will be rejected, so guessing the sequence numbers is the necessary step before the actual takeover can begin.

Taking a party offline (desynchronization) may be done after guessing sequence numbers if the attacker needs to prevent the legitimate client from interfering, not before.