312-50 Question 243
Single answer▪ Session Hijacking ConceptsDuring an authorized internal assessment, you discover that a legacy web application used by employees still accepts a session identifier in the URL, such as https://portal.example.local/account?SID=8F3A.... Users often click links sent through internal chat, and the application does not regenerate the session ID after login. To demonstrate a realistic session hijacking risk with minimal disruption, which attack would be the most appropriate to perform?
- A
Session fixation by sending the victim a preselected SID and waiting for them to authenticate with that same session
- B
SQL injection against the login form to dump the session table from the database
- C
ARP spoofing to capture the victim's password hash directly from HTTPS traffic
- D
DNS zone transfer to enumerate internal hosts and identify the session management server
Show answer and explanation
Correct answer: A
Explanation
The best answer is session fixation because the application accepts a session identifier from the client and does not regenerate it after authentication. Secure session management guidance from OWASP recommends generating a new session ID after login or privilege changes and avoiding exposure of session tokens in URLs, since URL-based session IDs can leak through browser history, logs, referrer headers, and user sharing. In a realistic CEH-style assessment, session fixation is the most direct, low-impact demonstration of risk here: the tester pre-establishes a known session token, induces the user to authenticate with it, and then reuses the authenticated token. The other options describe different attack categories that do not align as closely with the session hijacking concept in this scenario.
- A. Correct.
Correct. This scenario strongly indicates a session fixation weakness. If the application accepts a session ID supplied in the URL and fails to issue a new session ID after authentication, an attacker can provide a known SID to the victim before login. Once the victim authenticates, the attacker reuses that same SID to access the authenticated session. This is a classic session hijacking concept and is especially realistic when session tokens are accepted from URL parameters or other client-controlled sources.
- B. Incorrect.
Incorrect. SQL injection is a different class of vulnerability. While a vulnerable application could potentially expose session data through SQL injection, the scenario specifically highlights predictable abuse of session handling behavior, not input validation flaws in the login form. Choosing this option reflects the misconception that any authentication-related weakness should be exploited through the database layer rather than through session management itself.
- C. Incorrect.
Incorrect. ARP spoofing can position an attacker for man-in-the-middle attacks on a local network, but HTTPS is designed to protect the confidentiality of credentials and session cookies in transit when properly implemented. You would not expect to capture a password hash directly from encrypted HTTPS traffic. This option confuses network interception with successful decryption or TLS compromise.
- D. Incorrect.
Incorrect. DNS zone transfer is used to enumerate DNS records when misconfigured, not to hijack an authenticated user session. Although host enumeration can support reconnaissance, it does not directly exploit the session weakness described. This distractor targets the common mistake of selecting a generally useful recon technique instead of the attack that best matches the observed vulnerability.