Session Hijacking Exam 2023 Questions and Answers with
complete solution
In order to hijack TCP traffic, an attacker has to understand the next sequence and the
acknowledge number that the remote computer expects. Explain how the sequence and
acknowledgment numbers are incremented during the 3-way handshake process.
Sequence and acknowledgment numbers are incremented by one during the 3-way
handshake process
Sequence and acknowledgment numbers are incremented by two during the 3-way
handshake process
Sequence number is incremented by one and acknowledge number is not incremented
during the 3-way handshake process
Sequence number is not incremented and acknowledgment number is incremented by
one during the 3-way handshake process
Sequence and acknowledgment numbers are incremented by one during the 3-way
handshake process
During a penetration test, Marin identified a web application that could be exploited to
gain a root shell on the remote machine. The only problem was that in order to do that
he would have to know at least one valid username and password that could be used in
the application. Unfortunately, guessing usernames and brute-forcing passwords did not
work. Marin does not want to give up his attempts. Since this web application is being
used by almost all users in the company, and moreover it was using the http protocol,
so he decided to use the Cain&Abel tool in order to identify at least one username and
password. Morin found that the network was using layer 2 switches with no
configuration or management features. What could be the easiest way to start an attack
in this case?
MitM (Man in the Middle)
ARP spoofing
DNS spoofing
MitB (Man in the Browser)
MitM (Man in the Middle)
During the penetration testing, Marin identified a web application that could be exploited
to gain the root shell on the remote machine. The only problem was that in order to do
that he would have to know at least one username and password usable in the
application. Unfortunately, guessing usernames and brute-forcing passwords did not
, work. Marin does not want to give up his attempts. Since this web application,was being
used by almost all users in the company and was using http protocol, so he decided to
use Cain & Abel tool in order to identify at least one username and password. After a
few minutes, the first username and password popped-up and he successfully exploited
the web application and the physical machine. What type of attack did he use in order to
find the username and password to access the web application?
ARP spoofing
DNS spoofing
TCP protocol hijacking
UDP protocol hijacking
ARP spoofing
An attacker is using session hijacking on the victim system to perform further
exploitation on the target network. Identify the type of attacks an attacker can perform
using session hijacking?
Sniffing
Piggybacking
Dumpster Diving
Tailgating
Sniffing
When a person (or software) steals, can calculate, or can guess part of the
communication channel between client and the server application or protocols used in
the communication, he can hijack the ______.
Session
Channel
TCP protocol
UDP protocol
Session
During a penetration test, Marin exploited a blind SQLi and exfiltrated session tokens
from the database. What can he do with this data?
Marin can do Session hijacking
Marin can do SQLi (SQL injection)
complete solution
In order to hijack TCP traffic, an attacker has to understand the next sequence and the
acknowledge number that the remote computer expects. Explain how the sequence and
acknowledgment numbers are incremented during the 3-way handshake process.
Sequence and acknowledgment numbers are incremented by one during the 3-way
handshake process
Sequence and acknowledgment numbers are incremented by two during the 3-way
handshake process
Sequence number is incremented by one and acknowledge number is not incremented
during the 3-way handshake process
Sequence number is not incremented and acknowledgment number is incremented by
one during the 3-way handshake process
Sequence and acknowledgment numbers are incremented by one during the 3-way
handshake process
During a penetration test, Marin identified a web application that could be exploited to
gain a root shell on the remote machine. The only problem was that in order to do that
he would have to know at least one valid username and password that could be used in
the application. Unfortunately, guessing usernames and brute-forcing passwords did not
work. Marin does not want to give up his attempts. Since this web application is being
used by almost all users in the company, and moreover it was using the http protocol,
so he decided to use the Cain&Abel tool in order to identify at least one username and
password. Morin found that the network was using layer 2 switches with no
configuration or management features. What could be the easiest way to start an attack
in this case?
MitM (Man in the Middle)
ARP spoofing
DNS spoofing
MitB (Man in the Browser)
MitM (Man in the Middle)
During the penetration testing, Marin identified a web application that could be exploited
to gain the root shell on the remote machine. The only problem was that in order to do
that he would have to know at least one username and password usable in the
application. Unfortunately, guessing usernames and brute-forcing passwords did not
, work. Marin does not want to give up his attempts. Since this web application,was being
used by almost all users in the company and was using http protocol, so he decided to
use Cain & Abel tool in order to identify at least one username and password. After a
few minutes, the first username and password popped-up and he successfully exploited
the web application and the physical machine. What type of attack did he use in order to
find the username and password to access the web application?
ARP spoofing
DNS spoofing
TCP protocol hijacking
UDP protocol hijacking
ARP spoofing
An attacker is using session hijacking on the victim system to perform further
exploitation on the target network. Identify the type of attacks an attacker can perform
using session hijacking?
Sniffing
Piggybacking
Dumpster Diving
Tailgating
Sniffing
When a person (or software) steals, can calculate, or can guess part of the
communication channel between client and the server application or protocols used in
the communication, he can hijack the ______.
Session
Channel
TCP protocol
UDP protocol
Session
During a penetration test, Marin exploited a blind SQLi and exfiltrated session tokens
from the database. What can he do with this data?
Marin can do Session hijacking
Marin can do SQLi (SQL injection)
