Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID…

Question

Options

• ASession donation attack
• BSession fixation attack
• CForbidden attack
• DCRIME attack

• A
  72% (18)
• B
  4% (1)
• C
  16% (4)
• D
  8% (2)

Explanation

Session Donation Attack Explained

Option A is correct because a session donation attack occurs when an attacker gives (donates) their own valid session ID to a victim, tricking the victim into using the attacker's session. Unlike session fixation, the key distinction here is the MITM delivery method and the fact that Boney's account is pre-authenticated - when the victim submits payment details, they are stored in Boney's account, not the victim's.

Why the distractors are wrong:

• B (Session Fixation) is close but differs in that fixation forces a specific session ID before authentication, then hijacks the session after the victim logs in - here, Boney is already logged in and donating his session
• C (Forbidden Attack) targets TLS/SSL nonce reuse in HTTPS to forge authentication tags - completely unrelated to session manipulation
• D (CRIME Attack) is a compression-based side-channel attack that exploits TLS/SPDY data compression to recover session cookies - also unrelated to this scenario

Memory Tip: Think of "donation" literally - Boney gives a gift (his session ID) to the victim, linking the victim's actions to Boney's account. If the attacker is donating their session rather than stealing one, it's a session donation attack.

No community discussion yet for this question.