Dan is conducting penetration testing and has found a vulnerability in a Web Application which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to replay this token. However, the session ID manager (on the server) checks the originating IP address as well. Dan decides to spoof his IP address in order to replay the sessionID. Why do you think Dan might not be able to get an interactive session?

Question

Accepted Answer

C. The server will send replies back to the spoofed IP address

Answer

A. Dan cannot spoof his IP address over TCP network

Answer

B. The scenario is incorrect as Dan can spoof his IP and get responses

Answer

D. Dan can establish an interactive session only if he uses a NAT

Dan is conducting penetration testing and has found a vulnerability in a Web Application which gave him the sessionID token via a cross site scripting vulnerability. Dan wants to replay this token…

Question

Options

How the community answered

Community Discussion