What is a session fixation attack?

Question

Options

• AInjecting malicious session data into a server
• BForcing a user to use a known session ID
• CBrute-forcing a session ID to gain unauthorized access
• DTerminating user sessions remotely

• A
  7% (4)
• B
  75% (43)
• C
  5% (3)
• D
  12% (7)

Explanation

Session fixation is an attack where an adversary pre-establishes a session ID and then tricks a victim into authenticating with that same ID - so the attacker already "knows" the session and can immediately hijack it after login. This makes B correct: the attack's defining characteristic is forcing a user to use a known session ID, not discovering one after the fact.

Why the distractors are wrong:

• A (injecting malicious session data) describes session poisoning or data injection - a different class of attack targeting the contents of a session, not its ID.
• C (brute-forcing a session ID) describes a session prediction/guessing attack - the attacker doesn't know the ID in advance; they try to discover one.
• D (terminating sessions remotely) is closer to a DoS or session invalidation attack, which disrupts access rather than stealing it.

Memory tip: Think of "fixation" literally - the attacker fixes (locks in) the session ID before the victim logs in, then waits. If the server doesn't rotate the session ID on login, the attacker rides in on the victim's authenticated session. The defense is always regenerating the session ID upon successful authentication.

No community discussion yet for this question.