Module Summary

  • In session hijacking, an attacker relies on the legitimate user to connect and authenticate, and will then take over the session.
  • In a spoofing attack, the attacker pretends to be another user or machine to gain access.
  • Successful session hijacking is difficult and is only possible when a number of factors are under the attacker's control.
  • Session hijacking can be active or passive in nature depending on the degree of involvement of the attacker.
  • By attacking the network-level sessions, the attacker gathers some critical information that is used to attack the application-level sessions.
  • A variety of tools exist to aid the attacker in perpetrating a session hijack.
  • Session hijacking could be dangerous, and therefore, there is a need for implementing strict countermeasures.

Q1) What type of session hijacking attack is shown in the exhibit?

  1. Session Sniffing Attack
  2. Cross-site scripting Attack
  3. SQL Injection Attack
  4. Token sniffing Attack

Q2) After a client sends a connection request (SYN) packet to the server, the server will respond (SYN-ACK) with a sequence number of its choosing, which then must be acknowledged (ACK) by the client. This sequence number is predictable; the attack connects to a service first with its own IP address, records the sequence number chosen, and then opens a second connection from a forged IP address. The attack doesn't see the SYN-ACK (or any other packet) from the server, but can guess the correct responses. If the source IP address is used for authentication, then the attacker can use the one-sided communication to break into the server. What attacks can you successfully launch against a server using the above technique?

  1. Denial of Service attacks
  2. Session Hijacking attacks
  3. Web page defacement attacks
  4. IP spoofing attacks

Q3) John is using tokens for the purpose of strong authentication. He is not confident that his security is considerably strong.

In the context of Session hijacking why would you consider this as a false sense of security?

  1. The token based security cannot be easily defeated.
  2. The connection can be taken over after authentication.
  3. A token is not considered strong authentication.
  4. Token security is not widely used in the industry.

A3) A token will give you a more secure authentication,but the tokens will not help against attacks that are directed against you after you have been authenticated.

Q4) What is the key advantage of Session Hijacking?

  1. It can be easily done and does not require sophisticated skills.
  2. You can take advantage of an authenticated connection.
  3. You can successfully predict the sequence number generation.
  4. You cannot be traced in case the hijack is detected.

A4) As an attacker you don’t have to steal an account and password in order to take advantage of an authenticated connection.

Q5) You want to carry out session hijacking on a remote server. The server and the client are communicating via TCP after a successful TCP three way handshake. The server has just received packet #120 from the client. The client has a receive window of 200 and the server has a receive window of 250.

Within what range of sequence numbers should a packet, sent by the client fall in order to be accepted by the server?

  1. 200-250
  2. 121-371
  3. 120-321
  4. 121-231
  5. 120-370

A5) Package number 120 have already been received by the server and the window is 250 packets, so any package number from 121 (next in sequence) to 371 (121+250). (?)

Q6) How would you prevent session hijacking attacks?

  1. Using biometrics access tokens secures sessions against hijacking
  2. Using non-Internet protocols like http secures sessions against hijacking
  3. Using hardware-based authentication secures sessions against hijacking
  4. Using unpredictable sequence numbers secures sessions against hijacking

A6) Protection of a session needs to focus on the unique session identifier because it is the only thing that distinguishes users. If the session ID is compromised,attackers canimpersonate other users on the system. The first thing is to ensure that the sequence of identification numbers issued by the session management system is unpredictable; otherwise,it's trivial to hijack another user's session. Having a large number of possible session IDs (meaning that they should be very long) means that there are a lot more permutations for an attacker to try.

Q7) Which of the following attacks takes best advantage of an existing authenticated connection?

  1. Spoofing
  2. Session Hijacking
  3. Password Sniffing
  4. Password Guessing

A7) Session hijacking is the act of taking control of a user session after successfully obtaining or generating an authentication session ID. Session hijacking involves an attacker using captured,brute forced or reverse-engineered session IDs to seize control of a legitimate user's Web application session while that session is still in progress.

Q8) What type of information can be obtained during a session-hijacking attack? (Choose all that apply.) (?)

  1. Passwords
  2. Credit card numbers
  3. Confidential data
  4. Authentication information

A8) Passwords, credit card numbers, and other confidential data can be gathered in a session-hijacking attack. Authentication information isn’t accessible because session hijacking occurs after the user has authenticated.

Q9) Which of the following is essential information to a hacker performing a session-hijacking attack?

  1. Session ID
  2. Session number
  3. Sequence number
  4. Source IP address

A9) In order to perform a session-hijacking attack, the hacker must know the sequence number to use in the next packet so the server will accept the packet.

Q10) Which of the following is a session-hijacking tool that runs on Linux operating systems? (?)

  1. Juggernaut
  2. Hunt
  3. TTYWatcher
  4. TCP Reset Utility

A10)

  • Juggernaut runs on Linux operating systems。
  • Hunt現在也有Linux版了。

Q11) Which of the following is the best countermeasure to session hijacking?

  1. Port filtering firewall
  2. Encryption
  3. Session monitoring
  4. Strong passwords

A11) Encryption make any information the hacker gathers during a session-hijacking attempt unreadable.

Q12) Which of the following best describes sniffing? (?)

  1. Gathering packets to locate IP addresses, in order to initiate a session-hijacking attack
  2. Analyzing packets in order to locate the sequence number to start a session hijack
  3. Monitoring TCP sessions in order to initiate a session-hijacking attack
  4. Locating a host susceptible to a session-hijack attack

A12) Sniffing is usually used to locate the sequence number, which is necessary for a session hijack.

Q13) What is session hijacking?

  1. Monitoring UDP session
  2. Monitoring TCP sessions
  3. Taking over UDP sessions
  4. Taking over TCP sessions

A13) The most common form of session hijacking is the process of taking over a TCP session.

Q14) What types of packets are sent to the victim of a session-hijacking attack to cause them to close their end of the connection?

  1. FIN and ACK
  2. SYN or ACK
  3. SYN and ACK
  4. FIN or RST

A14) FIN (finish) and RST (reset) packets are sent to the victim to desynchronize their connection and cause them to close the existing connection.

Q15) Which of the following is the best way to protect against session hijacking?

  1. Use only nonroutable protocols.
  2. Use unpredictable sequence numbers.
  3. Use a file verification application, such as Tripwire.
  4. Use a good password policy.

A15) Unpredictable sequence numbers make session hijacking nearly impossible.

Q16) Which of the following attacks an already-authenticated connection?

  1. Smurf
  2. Denial of service
  3. Session hijacking
  4. Phishing

A16) Session hijacking takes advantage of connections already in place and already authenticated.

Q17) Which statement defines session hijacking most accurately?

  1. Session hijacking involves stealing a user’s login information and using that information to pose as the user later.
  2. Session hijacking involves assuming the role of a user through the compromise of physical tokens such as common access cards.
  3. Session hijacking is an attack that aims at stealing a legitimate session and posing as that user while communicating with the web resource or host machine.
  4. Session hijacking involves only web applications and is specific to stealing session IDs from compromised cookies.

A17) Session hijacking focuses on the victim’s session. There are different ways of accomplishing this task, but the basic concept is the same. Be sure to know what constitutes a session hijack; the exam will expect you to be able to recognize one at first glance.

Q18) Network-level hijacking focuses on the mechanics of a connection such as the manipulation of packet sequencing. What is the main focus of web app session hijacking?

  1. Breaking user logins
  2. Stealing session IDs
  3. Traffic redirection
  4. Resource DoS

A18) Stealing session IDs is the main objective in web session hijacking. Session IDs allow the attacker to assume the role of the legitimate client without the time-consuming task of brute-forcing user logins or sniffing out authentication information.

Q19) Session hijacking can be performed on all of the following protocols except which one?

  1. FTP
  2. SMTP
  3. HTTP
  4. SSL

A19) SSL is designed with many goals in mind; one of them is that it is not as vulnerable to session hijacking as the other protocols listed here.

Q20) Which technology can provide protection against session hijacking?

  1. IPSec
  2. UDP
  3. TCP
  4. IDS

Q21) Session hijacking can be thwarted with which of the following? (?)

  1. SSH
  2. FTP
  3. Authentication
  4. Sniffing

A21) Authentication mechanisms such as Kerberos can provide protection against session hijacking. Authentication provides verification of the party or parties involved in the communication.

Q22) Session hijacking can do all of the following except which one?

  1. Take over an authenticated session
  2. Be used to steal cookies
  3. Take over a session
  4. Place a cookie on a server

A22) A session hijack can be used to read cookies on a client but not on a server.

Q23) Which attack can be used to take over a previous session?

  1. Cookie snooping
  2. Session hijacking
  3. Cookie hijacking
  4. Session sniffing

A23) Session hijacking can be used to take over an existing session that has been authenticated, or to forge a valid session.

results matching ""

    No results matching ""