nerdexam
GIAC

GPEN · Question #189

Which of the following statements are true about session hijacking? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is B. TCP session hijacking is when a hacker takes over a TCP session between two machines. C. Use of a long random number or string as the session key reduces session hijacking. D. It is the exploitation of a valid computer session to gain unauthorized access to information or. Session hijacking involves taking over an active authenticated session to gain unauthorized access, and is distinct from denial-of-service attacks. Strong, random session keys are a key defensive countermeasure.

Exploitation & Post-Exploitation Techniques

Question

Which of the following statements are true about session hijacking? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AIt is used to slow the working of victim's network resources.
  • BTCP session hijacking is when a hacker takes over a TCP session between two machines.
  • CUse of a long random number or string as the session key reduces session hijacking.
  • DIt is the exploitation of a valid computer session to gain unauthorized access to information or

How the community answered

(24 responses)
  • A
    21% (5)
  • B
    79% (19)

Why each option

Session hijacking involves taking over an active authenticated session to gain unauthorized access, and is distinct from denial-of-service attacks. Strong, random session keys are a key defensive countermeasure.

AIt is used to slow the working of victim's network resources.

Slowing or exhausting a victim's network resources describes a Denial-of-Service (DoS) attack, which is a separate attack category from session hijacking.

BTCP session hijacking is when a hacker takes over a TCP session between two machines.Correct

TCP session hijacking is the precise technical definition - an attacker intercepts and takes control of an established TCP session between two communicating hosts, often by predicting or stealing the sequence number.

CUse of a long random number or string as the session key reduces session hijacking.Correct

A long, cryptographically random session key makes it computationally infeasible for an attacker to guess or brute-force the session token, directly mitigating session prediction attacks.

DIt is the exploitation of a valid computer session to gain unauthorized access to information orCorrect

Session hijacking is by definition the exploitation of a legitimately established session to gain unauthorized access to resources or services without proper authentication.

Concept tested: Session hijacking techniques and countermeasures

Source: https://owasp.org/www-community/attacks/Session_hijacking_attack

Topics

#session hijacking#TCP hijacking#session key#unauthorized access

Community Discussion

No community discussion yet for this question.

Full GPEN Practice