Which of the following should a penetration tester attack to gain control of the state in the HTTP protocol after the user is logged in?

HTTPS communication protects the confidentiality and integrity of data in transit, but attacking it typically involves decrypting traffic, not directly controlling the state of an already logged-in user in the application layer.

Public and private keys are used for encryption and digital signatures, particularly in SSL/TLS, which secures the communication channel, not the application-level session state.

Password encryption protects user credentials during storage or transmission. Once a user is logged in, their session state is managed independently of the initial password encryption.

After a user logs in, HTTP, being a stateless protocol, relies on mechanisms like sessions and cookies to maintain the user's authenticated state across requests. By compromising session tokens or cookies, a penetration tester can hijack a user's session and gain unauthorized access to their authenticated account without needing their credentials.