Ethical Hacking Session Hijacking Flashcards

24 sample cards from the Session Hijacking deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is Multi-Factor Authentication (MFA)?

   MFA is an authentication method requiring two or more independent verification factors from different categories—something you know (password), something you have (token/phone), and something you are (biometric)—so a compromise of one factor alone is insufficient to authenticate.

2. List the three standard authentication factor categories used in MFA.

   Knowledge factor (something you know—password, PIN); Possession factor (something you have—hardware token, phone/OTP app, smart card); Inherence factor (something you are—fingerprint, face, iris, or other biometric).

3. Does MFA prevent session hijacking after login? Explain.

   Not by itself. MFA protects the authentication step, but once a session token is issued, a hijacked token bypasses MFA. Defenses like short session lifetimes, re-authentication for sensitive actions, and token binding are needed to limit post-login hijacking.

4. What is session fixation, and how does it differ from session hijacking by theft?

   In session fixation, the attacker sets or supplies a known session ID to the victim before login; when the victim authenticates, that ID becomes authenticated and the attacker reuses it. Unlike theft, the attacker plants a token in advance rather than stealing one afterward.

5. What is the primary defense against session fixation?

   Regenerate (rotate) the session ID upon privilege change—especially immediately after successful login—so any pre-authentication ID an attacker planted becomes invalid and cannot be reused.

6. Why should session IDs be long and cryptographically random?

   To resist brute-force guessing and prediction attacks. High entropy (a large, unpredictable keyspace) makes it computationally infeasible for an attacker to guess a valid active session ID.

7. If a session ID has $n$ bits of entropy, how many possible values exist, and what does that imply for guessing?

   There are $2^{n}$ possible values. An attacker's expected number of guesses to hit a valid one is on the order of $\frac{2^{n}}{A}$ where $A$ is the number of currently active sessions, so large $n$ with sparse active sessions makes guessing infeasible.

8. How does session timeout (idle and absolute) reduce hijacking risk?

   Idle timeout invalidates a session after a period of inactivity; absolute timeout caps total session lifetime regardless of activity. Both shrink the window during which a stolen token remains valid, limiting how long an attacker can exploit it.

9. What is token binding as a defense against session hijacking?

   Token binding cryptographically ties the session token to properties of the client's TLS connection (or a client key). A stolen token cannot be replayed from a different connection because it is bound to the original client's cryptographic context.

10. How can binding a session to client attributes (IP, user-agent) help detect hijacking, and what is its limitation?

    If the session's IP address or user-agent suddenly changes mid-session, the server can flag or invalidate it as potential hijacking. Limitation: legitimate users' IPs change (mobile networks, proxies), causing false positives, and attributes can be spoofed—so it is a supplementary, not sole, defense.

11. What is a replay attack in the session context, and what mitigates it?

    A replay attack captures a valid token or request and resubmits it to gain access. Mitigations include short-lived tokens, nonces, timestamps, sequence numbers, and TLS, which prevent reuse of intercepted authentication data.

12. Why is regenerating the session ID after login (session renewal) an important control?

    It ensures the authenticated session uses a fresh, server-generated ID unknown to attackers, defeating session fixation and invalidating any pre-login token that may have been observed or set by an adversary.

13. What is the difference between session hijacking and Cross-Site Request Forgery (CSRF)?

    Session hijacking steals or takes over the session token to impersonate the user directly. CSRF does not steal the token—it tricks the victim's browser into sending an authenticated request (with its cookie automatically attached) to perform an unwanted action.

14. Name common tools used to demonstrate/perform session hijacking or the sniffing that enables it.

    Examples include Wireshark and tcpdump (packet sniffing), Ettercap and Bettercap (ARP spoofing/MitM), Cain & Abel, Hamster/Ferret, and browser tools like the historical Firesheep for capturing session cookies on open networks.

15. Why are open/public Wi-Fi networks especially risky for session hijacking?

    On unencrypted or shared wireless networks, any participant can sniff traffic. If a site transmits session cookies over HTTP (unencrypted), an attacker on the same network can capture and reuse them—historically demonstrated by tools like Firesheep.

16. How does end-to-end HTTPS with HSTS defend against MitM/SSL-stripping session hijacking?

    HTTPS encrypts session data in transit; HTTP Strict Transport Security (HSTS) forces the browser to use HTTPS only and refuse HTTP downgrades, preventing SSL-stripping attacks that would otherwise expose session cookies in cleartext.

17. What is the security purpose of the __Host- cookie name prefix?

    The __Host- prefix requires the cookie to be set with the Secure flag, no Domain attribute (host-only), and Path=/. Browsers reject cookies with this prefix that violate those rules, hardening session cookies against being overwritten or scoped insecurely by subdomains.

18. Explain the general concept of TCP sequence number prediction as an attack.

    An attacker guesses the next sequence and acknowledgment numbers of an established TCP connection to inject forged packets the endpoints will accept. If ISNs are predictable, the attacker can hijack or spoof the connection; randomized ISNs largely defeat this.

19. What is the defense-in-depth relationship between encryption, secure cookies, and MFA against session hijacking?

    Encryption (TLS) protects tokens in transit; secure cookie flags (HttpOnly, Secure, SameSite) protect tokens at the browser from theft and misuse; MFA strengthens the initial authentication. Layered together they close multiple attack vectors—no single control is sufficient alone.

20. Why is logging out (session invalidation) an important defense, and what must the server do?

    Logout should invalidate the session server-side, not just delete the client cookie. If the server keeps the token valid, a previously stolen token still works. Proper logout destroys the server-side session record, immediately revoking any hijacked copy.

21. How does XSS bypass the Same-Origin Policy to steal session cookies?

    XSS injects script that runs within the victim site's own origin, so it is not blocked by the Same-Origin Policy—it has legitimate access to the page's DOM and (unless HttpOnly is set) its cookies, which it then sends to an attacker-controlled origin.

22. What distinguishes a passive MitM from an active MitM attack?

    Passive MitM only eavesdrops on and records traffic without modifying it (confidentiality breach). Active MitM alters, injects, or blocks traffic—e.g., changing requests, stripping SSL, or injecting content—affecting integrity and enabling direct session takeover.

23. How does re-authentication for sensitive operations mitigate the impact of a hijacked session?

    Even if an attacker holds a valid session token, requiring a fresh credential or MFA prompt (step-up authentication) before high-risk actions—like changing a password or transferring funds—prevents the hijacker from completing the most damaging operations.

24. Summarize the core countermeasures against session hijacking a student should memorize.

    Use HTTPS/TLS everywhere with HSTS; set cookies with HttpOnly, Secure, and SameSite flags; generate long, random session IDs; regenerate IDs after login; enforce idle and absolute timeouts; invalidate sessions on logout; prevent XSS (input validation/output encoding, CSP); use token binding; and apply MFA plus step-up re-authentication.

What this deck covers

Session Hijacking flashcards FAQ