Bob is going to perform an active session hijack against Brownies Inc. He has found a target that allows session oriented connections (Telnet) and performs the sequence prediction on the target…

Taking over the session is the final goal of the attack, not the immediate next step - the attacker cannot inject valid packets without first determining the correct sequence numbers.

Reverse sequence prediction is not a recognized step in TCP session hijacking - the attacker predicts the next forward sequence number, not a reversed one.

In active session hijacking, after identifying a live session, the attacker must guess or predict the next TCP sequence number the target host will accept. Without the correct sequence number, the target discards injected packets as out-of-order. Accurate sequence number prediction is the critical prerequisite to desynchronizing the session and subsequently taking it over.

Taking one of the parties offline to prevent ACK storms is a step that typically follows sequence number prediction, not one that precedes it.