A penetration tester is performing a wireless network assessment and wants to capture session cookies from unencrypted HTTP traffic. The tester has already gained access to the same Wi-Fi network as the target. Which tool would be most appropriate for this task, and what is the primary limitation of this approach?

Burp Suite; it requires a proxy configuration on the target device

Hamster; it only works on HTTPS traffic

Ettercap; it can decrypt HTTPS traffic on the fly

Wireshark; it can only capture traffic that is not encrypted

A security consultant is assessing a web application that uses a session token stored in a cookie. The application is behind a load balancer that terminates TLS. The consultant discovers that the session token is also included in the URL query string for tracking purposes. Which attack is most directly enabled by this design, and what is the most effective mitigation?

Cross-site scripting; sanitize all user input

Session leakage via HTTP Referer headers; remove the session token from the URL

Session sidejacking; use HTTPS for all traffic

Session fixation; regenerate the session ID after login

A penetration tester is assessing a web application that uses a session cookie. The tester discovers that the application accepts any session ID provided by the client and does not regenerate the session ID after login. Which attack is the tester most likely to demonstrate?

Cross-site request forgery (CSRF)

Which of the following is an effective countermeasure against session hijacking?

Using HTTPS to encrypt session IDs in transit

Accepting session IDs from any source without validation

Using short session IDs to reduce predictability

Storing session IDs in URL parameters for easy access

A security analyst is reviewing a web application that stores session tokens in a JavaScript-accessible cookie and transmits them over HTTP. The analyst wants to reduce the risk of session theft via XSS and network sniffing. Which two configuration changes should the analyst recommend?

Set the Secure flag and the HttpOnly flag on the session cookie

Use a longer session ID and store it in a hidden form field

Set the SameSite attribute to Strict and increase the session timeout

Enable HTTP Strict Transport Security (HSTS) and use a Content Security Policy (CSP)

EC-CouncilCertified Ethical Hacker

Domain 4Objective 4

Session Hijacking CEH Practice Questions (Page 5)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 21–25

21application · medium
A penetration tester is performing a wireless network assessment and wants to capture session cookies from unencrypted HTTP traffic. The tester has already gained access to the same Wi-Fi network as the target. Which tool would be most appropriate for this task, and what is the primary limitation of this approach?
Select an answer first
22expert · hard
A security consultant is assessing a web application that uses a session token stored in a cookie. The application is behind a load balancer that terminates TLS. The consultant discovers that the session token is also included in the URL query string for tracking purposes. Which attack is most directly enabled by this design, and what is the most effective mitigation?
Select an answer first
23application · medium
A penetration tester is assessing a web application that uses a session cookie. The tester discovers that the application accepts any session ID provided by the client and does not regenerate the session ID after login. Which attack is the tester most likely to demonstrate?
Select an answer first
24foundation · easy
Which of the following is an effective countermeasure against session hijacking?
Select an answer first
25application · medium
A security analyst is reviewing a web application that stores session tokens in a JavaScript-accessible cookie and transmits them over HTTP. The analyst wants to reduce the risk of session theft via XSS and network sniffing. Which two configuration changes should the analyst recommend?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Session Hijacking CEH Practice Questions (Page 5)

Questions 21–25

A penetration tester is assessing a web application that uses a session cookie. The tester discovers that the application accepts any session ID provided by the client and does not regenerate the session ID after login. Which attack is the tester most likely to demonstrate?

Which of the following is an effective countermeasure against session hijacking?

A security analyst is reviewing a web application that stores session tokens in a JavaScript-accessible cookie and transmits them over HTTP. The analyst wants to reduce the risk of session theft via XSS and network sniffing. Which two configuration changes should the analyst recommend?

Keep studying — Network and Perimeter Hacking