Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 1 — Questions and Answers
Question 1: Which type of session hijacking intercepts a session between two parties without requiring prediction of a sequence number?
- Blind Hijacking
- Active Hijacking
- Passive Hijacking (Correct answer)
- UDP Hijacking
Correct answer: Passive Hijacking
Passive hijacking involves monitoring a session to capture sensitive data without actively injecting packets, avoiding detection by not disrupting the session.
Question 2: What is the primary goal of TCP session hijacking?
- To crash the target server
- To take over an established TCP connection (Correct answer)
- To decrypt TLS traffic
- To perform a SYN flood attack
Correct answer: To take over an established TCP connection
TCP session hijacking aims to take control of an active TCP session by predicting or stealing sequence numbers to inject malicious packets.
Question 3: Which tool is commonly used for session hijacking and man-in-the-middle attacks on a LAN?
- Nmap
- Ettercap (Correct answer)
- Nikto
- Nessus
Correct answer: Ettercap
Ettercap is a comprehensive suite for man-in-the-middle attacks, capable of sniffing, session hijacking, and filtering live connections on a LAN.
Question 4: What countermeasure best prevents session hijacking caused by predictable session tokens?
- Disabling cookies
- Using long, randomly generated session IDs (Correct answer)
- Enforcing password complexity
- Enabling ICMP filtering
Correct answer: Using long, randomly generated session IDs
Long, cryptographically random session IDs are computationally infeasible to predict, preventing attackers from guessing valid session tokens.
Question 5: Which attack technique do attackers use to steal session cookies by injecting a script into a vulnerable web application?
- SQL Injection
- CSRF
- Cross-Site Scripting (XSS) (Correct answer)
- Command Injection
Correct answer: Cross-Site Scripting (XSS)
XSS can be used to inject malicious scripts that read and exfiltrate the victim's session cookies to the attacker's server.
Question 6: What is 'IP spoofing' used for in the context of session hijacking?
- Encrypting session data
- Masquerading as a trusted host to hijack a TCP session (Correct answer)
- Bypassing firewall rules via port forwarding
- Amplifying DoS traffic
Correct answer: Masquerading as a trusted host to hijack a TCP session
In session hijacking, IP spoofing allows the attacker to forge packets with a trusted source IP to impersonate a legitimate party in the TCP session.
Certified Ethical Hacker Session Hijacking and Evading IDS Firewalls 1
Which type of session hijacking intercepts a session between two parties without requiring prediction of a sequence number?