nerdexam
GIAC

GPEN · Question #76

You want to perform an active session hijack against Secure Inc. You have found a target that allows Telnet session. You have also searched an active session due to the high level of traffic on the…

The correct answer is C. Guess the sequence numbers. In active TCP session hijacking against Telnet, once an active session is identified the attacker must predict sequence numbers to inject forged packets into that session.

Exploitation & Post-Exploitation Techniques

Question

You want to perform an active session hijack against Secure Inc. You have found a target that allows Telnet session. You have also searched an active session due to the high level of traffic on the network. What should you do next?

Options

  • AUse a sniffer to listen network traffic.
  • BUse macoff to change MAC address.
  • CGuess the sequence numbers.
  • DUse brutus to crack telnet password.

How the community answered

(56 responses)
  • A
    9% (5)
  • B
    2% (1)
  • C
    84% (47)
  • D
    5% (3)

Why each option

In active TCP session hijacking against Telnet, once an active session is identified the attacker must predict sequence numbers to inject forged packets into that session.

AUse a sniffer to listen network traffic.

Sniffing is a reconnaissance step used to discover and monitor active sessions, but the question states an active session has already been found, so sniffing is no longer the next required action.

BUse macoff to change MAC address.

Changing a MAC address with macof or macchanger is relevant to ARP-based attacks and MAC filtering bypass, not to TCP sequence-based session hijacking of an existing Telnet connection.

CGuess the sequence numbers.Correct

TCP sessions are maintained using sequence and acknowledgment numbers. To inject malicious packets into an existing Telnet session that the target will accept as legitimate, the attacker must accurately predict the current sequence number. Correct sequence number prediction is the core technical prerequisite that enables active session takeover after an active session has already been located.

DUse brutus to crack telnet password.

Brutus is a password-cracking tool used for credential attacks against login prompts; cracking a Telnet password is a separate attack that does not apply when the goal is hijacking an already-established active session.

Concept tested: TCP sequence number prediction for active session hijacking

Source: https://owasp.org/www-community/attacks/Session_hijacking_attack

Topics

#session hijacking#TCP sequence numbers#telnet#active hijacking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice