GPEN · Question #189
Which of the following statements are true about session hijacking? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is B. TCP session hijacking is when a hacker takes over a TCP session between two machines. C. Use of a long random number or string as the session key reduces session hijacking. D. It is the exploitation of a valid computer session to gain unauthorized access to information or. Session hijacking involves taking over an active authenticated session to gain unauthorized access, and is distinct from denial-of-service attacks. Strong, random session keys are a key defensive countermeasure.
Question
Which of the following statements are true about session hijacking? Each correct answer represents a complete solution. Choose all that apply.
Options
- AIt is used to slow the working of victim's network resources.
- BTCP session hijacking is when a hacker takes over a TCP session between two machines.
- CUse of a long random number or string as the session key reduces session hijacking.
- DIt is the exploitation of a valid computer session to gain unauthorized access to information or
How the community answered
(24 responses)- A21% (5)
- B79% (19)
Why each option
Session hijacking involves taking over an active authenticated session to gain unauthorized access, and is distinct from denial-of-service attacks. Strong, random session keys are a key defensive countermeasure.
Slowing or exhausting a victim's network resources describes a Denial-of-Service (DoS) attack, which is a separate attack category from session hijacking.
TCP session hijacking is the precise technical definition - an attacker intercepts and takes control of an established TCP session between two communicating hosts, often by predicting or stealing the sequence number.
A long, cryptographically random session key makes it computationally infeasible for an attacker to guess or brute-force the session token, directly mitigating session prediction attacks.
Session hijacking is by definition the exploitation of a legitimately established session to gain unauthorized access to resources or services without proper authentication.
Concept tested: Session hijacking techniques and countermeasures
Source: https://owasp.org/www-community/attacks/Session_hijacking_attack
Topics
Community Discussion
No community discussion yet for this question.