Session Fixation WAHS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is manually testing a web application for session fixation. The application uses a session cookie. The tester has a valid account. Which sequence of steps would correctly demonstrate the vulnerability?

   • AUse a proxy to intercept the login request and modify the password field
   • BLog in normally, then change the session cookie to a different value and see if the session remains valid
   • CCapture a session ID from the login page, log in using that session ID, and then check if the session ID remains the same after login
   • DCheck whether the session cookie has the Secure flag set
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A penetration tester is assessing a web application that uses a session ID in a cookie. The tester wants to determine if the application is vulnerable to session fixation. The application has a login page and a protected page. Which testing approach would yield the MOST reliable result while minimizing false positives?

   • AUse a browser to visit the login page, capture the session cookie, log in with that cookie, and then check if the cookie value changes after login
   • BSend a login request with a modified Referer header and observe if the session ID changes
   • CLog in normally, then manually change the session cookie to a random value and see if the session remains valid
   • DUse an automated scanner to check for the presence of the Secure flag on the session cookie
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the first step in manually testing a web application for session fixation?

   • AObtain a session ID from the application and note whether it changes after login.
   • BUse a vulnerability scanner to automatically exploit the application.
   • CCheck if the session cookie has the HttpOnly flag.
   • DTry to brute-force the session ID.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An attacker sends a victim a link that contains a session ID in a hidden form field. What is the attacker attempting to do?

   • AInject malicious JavaScript into the victim's browser.
   • BPerform a cross-site request forgery (CSRF) attack.
   • CDeliver a fixed session ID to the victim.
   • DSteal the victim's session ID after authentication.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An attacker wants to perform a session fixation attack against a web application. The application uses cookies for session management, but it also accepts a session ID from a 'sessionid' query parameter if present. Which delivery method would be most reliable for the attacker to set the victim's session ID?

   • ASend the victim a link that includes a fixed session ID in the query string.
   • BSubmit a hidden form field with a fixed session ID to the victim's browser.
   • CIntercept the victim's traffic and modify the session cookie in transit.
   • DUse JavaScript to overwrite the session cookie via document.cookie.
   Reveal Solution Discussion Select an answer first