Session Hijacking Techniques EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An attacker sends a victim a link that sets the victim's session ID to a known value. After the victim logs in, the attacker uses that known session ID to access the victim's account. Which step in the session hijacking process does this attack primarily exploit?

   • AInjecting a script to steal the cookie
   • BSniffing the network for the session token
   • CEstablishing a session with the target server
   • DPredicting the session ID
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary reason that using the HttpOnly flag on session cookies helps prevent XSS-based session hijacking?

   • AIt prevents client-side scripts from accessing the cookie via JavaScript
   • BIt encrypts the cookie so it cannot be read by the server
   • CIt causes the cookie to expire after a short time
   • DIt ensures the cookie is only sent over HTTPS connections
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the typical first step in a session hijacking attack?

   • ADisrupting the victim's network connection
   • BTracking the victim's session identifier
   • CSending a phishing email to the victim
   • DPredicting the victim's password
   Reveal Solution Discussion Select an answer first
5. 14expert · hard · select all that apply

   A security architect is designing a comprehensive session management strategy for a web application. The application must protect against session fixation, side-jacking, and XSS-based cookie theft. Which of the following controls should be implemented? Select all that apply.

   • AEnforce HTTPS and mark the session cookie as Secure.
   • BUse a longer session ID with more entropy.
   • CSet a shorter session timeout.
   • DSet the HttpOnly attribute on the session cookie.
   • ERegenerate the session ID after successful authentication.
   Check answers Discussion Select an answer first
6. 15application · medium

   A bank customer's browser has a malicious browser extension installed. When the customer logs into online banking, the extension silently modifies the page's JavaScript to change the destination account number in a fund transfer request. The transaction appears to succeed, but the money goes to the attacker's account. Which attack best describes this scenario?

   • ASession fixation
   • BSession ID prediction
   • CSession side-jacking
   • DMan-in-the-browser attack
   Reveal Solution Discussion Select an answer first