A bank's security team notices that some customers are seeing unauthorized transactions even though they are using HTTPS and their session cookies are Secure and HttpOnly. The bank suspects a man-in-the-browser attack. Which characteristic is most consistent with a man-in-the-browser attack?

The bank's web server has a weak random number generator that allows session ID prediction.

Malware on the victim's machine modifies the web page's DOM and submits transactions without the user's knowledge.

An attacker on the network captures the session cookie and replays it from another machine.

The user is tricked into clicking a link that sets a known session ID before logging in.

How does a man-in-the-browser attack contribute to session hijacking?

It can steal session cookies or modify session-related requests from within the browser

It intercepts network packets to capture session tokens

It forces the user to use a known session ID via a crafted link

It predicts the session ID by analyzing the server's algorithm

What is session hijacking in the context of web security?

An attack that forces a user to reveal their password through social engineering

An attack that modifies the content of web pages displayed to a user

An attack that floods a web server with traffic to make it unavailable

An attack where an attacker takes over a valid user session by stealing or predicting the session identifier

A security auditor is reviewing a web application that generates session IDs using a linear congruential generator with a known seed. The auditor determines that an attacker can predict future session IDs. Which countermeasure would be most effective?

Replace the session ID generator with a cryptographically secure random number generator

Set the HttpOnly flag on the session cookie

Bind the session to the user's IP address

EC-CouncilEthical Hacking Essentials

Domain 5Objective 3

Session Hijacking Techniques EHE Practice Questions (Page 7)

Part of the Network-Level Attacks and Countermeasures domain, which makes up ~12% of our current practice bank.

34questions here

7free pages

8concepts

Questions 31–34

31application · medium
A bank's security team notices that some customers are seeing unauthorized transactions even though they are using HTTPS and their session cookies are Secure and HttpOnly. The bank suspects a man-in-the-browser attack. Which characteristic is most consistent with a man-in-the-browser attack?
Select an answer first
32foundation · easy
How does a man-in-the-browser attack contribute to session hijacking?
Select an answer first
33foundation · easy
What is session hijacking in the context of web security?
Select an answer first
34application · medium
A security auditor is reviewing a web application that generates session IDs using a linear congruential generator with a known seed. The auditor determines that an attacker can predict future session IDs. Which countermeasure would be most effective?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.