Session Hijacking Techniques EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security consultant is testing a web application for session fixation. The application accepts a session ID from a URL parameter and does not validate the origin of the session ID. Which test would best confirm the vulnerability?

   • ASet a known session ID in the URL, log in, and check if the server continues to use that same session ID.
   • BInject a script that reads document.cookie and sends it to an external server.
   • CSend multiple requests with different session IDs and observe which ones are accepted.
   • DIntercept the traffic and look for the session cookie in plaintext.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is investigating a series of fraudulent transactions in an online banking application. The users are accessing the application from their personal computers, and the bank uses HTTPS, Secure cookies, and two-factor authentication. The bank suspects a man-in-the-browser attack. Which evidence would most strongly support this suspicion?

   • AThe users are being redirected to a phishing site that mimics the bank's login page.
   • BThe transactions are initiated from the same IP address as the user's legitimate sessions, and the user's browser shows signs of a browser helper object (BHO) or extension.
   • CThe session cookies are being sent to an external server in plaintext.
   • DThe session IDs are being generated in a predictable pattern.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester is assessing a web application that generates session IDs using a predictable pattern based on the current timestamp and a small random number. The tester successfully predicts a valid session ID for an authenticated user. Which countermeasure would be most effective in preventing this type of attack?

   • AUse a shorter session timeout
   • BUse a cryptographically secure random number generator for session IDs
   • CBind the session to the user's IP address
   • DSet the HttpOnly flag on the session cookie
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst at a coffee shop chain is investigating a report that customers using the shop's free Wi-Fi had their web sessions taken over. The analyst captures traffic and finds that the web application uses HTTP for login and then redirects to HTTPS for the rest of the session, but the session cookie is not marked Secure. Which combination of factors most directly enabled the session takeover?

   • AThe customer's browser stored the cookie in a location that allowed other browser extensions to read it.
   • BThe Wi-Fi network used WPA2, which is weak and allowed the attacker to decrypt all traffic.
   • CThe web server failed to encrypt the session ID with a strong algorithm, so the attacker could predict it.
   • DThe session cookie was transmitted in plaintext over the Wi-Fi network, allowing an attacker on the same network to capture it.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an effective countermeasure to prevent session hijacking?

   • ADisabling JavaScript in the browser
   • BUsing HTTPS to encrypt all communication between the client and server
   • CUsing a short session timeout to reduce the attack window
   • DUsing a firewall to block all incoming traffic
   Reveal Solution Discussion Select an answer first