Session Fixation WAHS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A penetration tester is assessing a web application that uses URL-based session IDs. The tester sends a victim a link containing a valid session ID, the victim clicks it, logs in, and the tester then uses the same session ID to access the victim's account. Which combination of application behaviors made this attack possible?

   • AThe application sets a session cookie without the Secure flag and relies on HTTPS only during login.
   • BThe application binds the session to the user's IP address and rejects any request from a different IP.
   • CThe application uses a long random session ID and expires sessions after 15 minutes of inactivity.
   • DThe application accepts session IDs from query strings and does not regenerate the session ID after authentication.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which sequence correctly describes the steps of a session fixation attack?

   • AVictim logs in → attacker uses a different session ID → victim is locked out.
   • BAttacker sets a session ID → victim authenticates with that ID → attacker uses the authenticated session.
   • CAttacker guesses the session ID → victim logs in → attacker changes the session ID.
   • DVictim authenticates → attacker steals the session ID → attacker uses the session.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security consultant is reviewing a web application that allows users to share links to resources. The application uses a session ID in the URL for tracking. The consultant finds that the session ID is not regenerated after login. Which combination of factors makes this application particularly vulnerable to session fixation?

   • AThe application uses HTTPS, and the session cookie has the Secure flag set
   • BThe application uses a short session timeout and requires re-authentication frequently
   • CThe session ID is exposed in URLs, and the application does not regenerate it after authentication
   • DThe application binds the session to the user's IP address
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A developer is fixing a session fixation vulnerability. The application currently uses a cookie named 'sessionid' and does not change it after login. The developer wants to ensure that after a user authenticates, any session ID that existed before login becomes useless. Which code change accomplishes this?

   • AAppend a timestamp to the session ID after login.
   • BCall session_regenerate_id(true) immediately after validating the user's credentials and before setting any authenticated session data.
   • CStore the user's IP address in the session and check it on every request.
   • DSet the session cookie's Max-Age to 0 after login so the browser deletes it.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application developer is reviewing code that manages user sessions. The application currently accepts session IDs from query strings and does not change the session ID after a user logs in. Which combination of changes would MOST effectively reduce the risk of session fixation?

   • AUse a longer session ID and set a shorter timeout
   • BReject session IDs from query strings and regenerate the session ID upon login
   • CSet the session cookie's Domain attribute to the application's domain and use HttpOnly
   • DStore the session ID in a hidden form field and validate it on each request
   Reveal Solution Discussion Select an answer first