Joe, a user, in a coffee shop is checking his email over a wireless network. An attacker records the temporary credentials being passed to Joe's browser. The attacker later uses the credentials to…

The correct answer is D. Session hijacking. This is a textbook session hijacking attack. When Joe authenticates, the server issues a temporary session token (credential) to his browser. The attacker intercepts this token - likely via a packet sniffer on the open wireless network - and then replays it to the server…

Threats, vulnerabilities, and mitigations

Question

Joe, a user, in a coffee shop is checking his email over a wireless network. An attacker records the temporary credentials being passed to Joe's browser. The attacker later uses the credentials to impersonate Joe and creates SPAM messages. Which of the following attacks allows for this impersonation?

Options

AXML injection
BDirectory traversal
CHeader manipulation
DSession hijacking

How the community answered

(23 responses)

A
4% (1)
B
4% (1)
D
91% (21)

Explanation

This is a textbook session hijacking attack. When Joe authenticates, the server issues a temporary session token (credential) to his browser. The attacker intercepts this token - likely via a packet sniffer on the open wireless network - and then replays it to the server, effectively impersonating Joe without needing his actual password. XML injection and directory traversal are application-layer attacks targeting data or file systems. Header manipulation is a technique sometimes used within session hijacking but is not the name of the overall attack. Session hijacking specifically describes stealing and reusing a valid session token to impersonate a legitimate user.

Topics

#session hijacking#wireless security#credential theft#attack types

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice