Session Hijacking Techniques EHE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common technique used in a session fixation attack?

   • ASending the victim a link that contains a session ID chosen by the attacker
   • BGuessing the session ID by brute force
   • CIntercepting the victim's network traffic to capture the session cookie
   • DInjecting malicious JavaScript to read the session cookie
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security engineer is reviewing a web application's session management. The application generates session IDs using a timestamp and a counter. Which attack is most likely to succeed against this implementation?

   • ASession fixation, because the attacker can force a known session ID.
   • BSession side-jacking, because the session ID is transmitted in plaintext.
   • CMan-in-the-browser attack, because the attacker can modify the session ID in the browser.
   • DSession ID prediction, because the attacker can guess valid session IDs by knowing the timestamp and counter.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a recommended countermeasure to prevent session fixation attacks?

   • ARegenerating the session ID after user authentication
   • BUsing a firewall to block malicious links
   • CUsing a longer session ID
   • DDisabling cookies in the browser
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network administrator is analyzing a packet capture from a public Wi-Fi network. The administrator sees a client sending an HTTP request with a session cookie in the header. Which step of a session hijacking attack is most directly enabled by this observation?

   • AFixing the session ID by sending a crafted link.
   • BPredicting the session ID by analyzing the cookie value.
   • CCapturing the session token via packet sniffing.
   • DInjecting malicious script into the web page.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A web application is being hardened against session hijacking. The team has already implemented HTTPS, Secure and HttpOnly cookies, and session regeneration after login. Which additional control would most directly reduce the risk of session hijacking via XSS?

   • AIncrease the session timeout to allow users to stay logged in longer.
   • BDisable cookies and use URL-based session IDs.
   • CUse a longer session ID to make brute-force attacks harder.
   • DImplement a Content Security Policy (CSP) that disallows inline scripts.
   Reveal Solution Discussion Select an answer first