GCIH · Question #282
Which of the following statements are true about session hijacking? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. Use of a long random number or string as the session key reduces session hijacking. C. TCP session hijacking is when a hacker takes over a TCP session between two machines. D. It is the exploitation of a valid computer session to gain unauthorized access to information. Session hijacking exploits an active authenticated session to gain unauthorized access, and using long random session keys is a primary defense because it makes tokens difficult to guess or brute-force.
Question
Which of the following statements are true about session hijacking? Each correct answer represents a complete solution. Choose all that apply.
Options
- AUse of a long random number or string as the session key reduces session hijacking.
- BIt is used to slow the working of victim's network resources.
- CTCP session hijacking is when a hacker takes over a TCP session between two machines.
- DIt is the exploitation of a valid computer session to gain unauthorized access to information
How the community answered
(42 responses)- A90% (38)
- B10% (4)
Why each option
Session hijacking exploits an active authenticated session to gain unauthorized access, and using long random session keys is a primary defense because it makes tokens difficult to guess or brute-force.
A long random session key greatly increases token entropy, making it computationally infeasible for an attacker to predict or brute-force the session identifier and take over an active session.
Slowing or exhausting a victim's network resources describes a Denial of Service attack, not session hijacking, which targets active authenticated sessions rather than network availability.
TCP session hijacking is precisely defined as an attacker seizing an established TCP session between two hosts by predicting sequence numbers or injecting spoofed packets mid-stream.
Session hijacking is by definition the exploitation of a valid, already-authenticated session token or cookie to impersonate a legitimate user and gain unauthorized access without requiring credentials.
Concept tested: Session hijacking definition, types, and mitigation
Source: https://owasp.org/www-community/attacks/Session_hijacking_attack
Topics
Community Discussion
No community discussion yet for this question.