nerdexam
GIAC

GCIH · Question #101

Which of the following tools will you use to prevent from session hijacking? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. OpenSSH D. SSL. OpenSSH and SSL both encrypt session traffic end-to-end, making it infeasible for attackers to intercept or replay session data. Rlogin and Telnet transmit data in plaintext and offer no protection against session hijacking.

Web Application Attacks & Post-Exploitation

Question

Which of the following tools will you use to prevent from session hijacking? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AOpenSSH
  • BRlogin
  • CTelnet
  • DSSL

How the community answered

(26 responses)
  • A
    92% (24)
  • B
    4% (1)
  • C
    4% (1)

Why each option

OpenSSH and SSL both encrypt session traffic end-to-end, making it infeasible for attackers to intercept or replay session data. Rlogin and Telnet transmit data in plaintext and offer no protection against session hijacking.

AOpenSSHCorrect

OpenSSH encrypts the entire communication channel using strong cryptographic algorithms such as AES and ChaCha20, ensuring session tokens and data cannot be captured or replayed by an attacker performing a man-in-the-middle or sniffing attack.

BRlogin

Rlogin transmits all session data including credentials in cleartext over the network, making it trivially vulnerable to packet sniffing and session hijacking.

CTelnet

Telnet sends all data unencrypted over the network, exposing session tokens and credentials to any attacker with network access, which directly enables session hijacking.

DSSLCorrect

SSL establishes an authenticated, encrypted tunnel between client and server, preventing attackers from reading session identifiers in transit or injecting spoofed packets into an active session.

Concept tested: Encrypted protocols preventing session hijacking

Source: https://owasp.org/www-community/attacks/Session_hijacking_attack

Topics

#session hijacking#SSL/TLS#OpenSSH#secure protocols

Community Discussion

No community discussion yet for this question.

Full GCIH Practice