nerdexam
GIAC

GCIH · Question #111

John works as a professional Ethical Hacker. He is assigned a project to test the security of are-secure network and intercept a conversation between two employees of the company through session…

The correct answer is A. Hunt. Hunt is a dedicated TCP session hijacking tool that can intercept and take over active sessions on a LAN.

Web Application Attacks & Post-Exploitation

Question

John works as a professional Ethical Hacker. He is assigned a project to test the security of are-secure network and intercept a conversation between two employees of the company through session hijacking. Which of the following tools will John use to accomplish the task?

Options

  • AHunt
  • BIPChains
  • CEthercap
  • DTripwire

How the community answered

(27 responses)
  • A
    89% (24)
  • C
    4% (1)
  • D
    7% (2)

Why each option

Hunt is a dedicated TCP session hijacking tool that can intercept and take over active sessions on a LAN.

AHuntCorrect

Hunt is specifically designed for TCP session hijacking, allowing an attacker to monitor, intercept, and take control of established TCP connections between hosts on a local network. It supports active hijacking by desynchronizing the legitimate client and injecting attacker-controlled data into the captured session.

BIPChains

IPChains is a Linux kernel packet filtering and firewall management tool used for network access control, not for intercepting or hijacking sessions.

CEthercap

Ettercap (the likely intended reference for 'Ethercap') is primarily an ARP poisoning and sniffing framework; while it can capture traffic, Hunt is the canonical purpose-built session hijacking tool for this scenario.

DTripwire

Tripwire is a host-based file integrity monitoring tool used to detect unauthorized changes to system files, not a network session hijacking utility.

Concept tested: TCP session hijacking using the Hunt tool

Source: https://attack.mitre.org/techniques/T1563/

Topics

#session hijacking#Hunt tool#TCP hijacking#network sniffing

Community Discussion

No community discussion yet for this question.

Full GCIH Practice