312-50 Question 245
Single answer▪ Session Hijacking ConceptsDuring an authorized web application assessment, you discover that the application issues a session cookie after login and does not regenerate the session ID after successful authentication. The cookie is also accepted by the server even when it was set before the user logged in. To demonstrate a realistic attack path, you want to show how an attacker could force a known session ID on a victim and then take over the authenticated session after the victim logs in. Which attack best matches this scenario?
- A
Session fixation
- B
TCP ACK storm hijacking
- C
Clickjacking
- D
Cross-site request forgery (CSRF)
Show answer and explanation
Correct answer: A
Explanation
The scenario describes a classic session fixation weakness: the application accepts a session ID established before login and does not regenerate it after successful authentication. In a real assessment, an attacker might send a victim a crafted link that sets a session token, inject a cookie through a related weakness, or otherwise cause the victim to use an attacker-known session ID. If the application fails to rotate the identifier after authentication, the attacker can later reuse that same token to hijack the authenticated session. Secure session management guidance from OWASP and common web security best practices recommend regenerating the session ID on privilege level changes, especially after login, and using secure cookie attributes such as HttpOnly and Secure where appropriate. However, the key control relevant here is session ID renewal after authentication to prevent fixation.
- A. Correct.
Correct. Session fixation occurs when an attacker sets or predicts a session identifier for a victim before authentication, and the application fails to issue a new session ID after login. If the victim authenticates using that same session, the attacker can reuse the known session ID to access the authenticated session. This is exactly the risk described in the scenario.
- B. Incorrect.
Incorrect. TCP ACK storm hijacking is a network-level issue related to desynchronizing TCP endpoints and causing excessive ACK exchanges after improper packet injection. It does not specifically describe forcing a web application to accept a pre-authentication session token that remains valid after login.
- C. Incorrect.
Incorrect. Clickjacking tricks a user into clicking hidden or disguised interface elements in a browser. While it can be used to induce unintended actions, it is not the core issue in this scenario, which centers on reuse of a fixed session identifier across authentication boundaries.
- D. Incorrect.
Incorrect. CSRF causes a victim's browser to send unwanted authenticated requests to a target application, but it does not require the attacker to know or set the victim's session ID. The scenario is specifically about preserving a known session token through login, which is characteristic of session fixation rather than CSRF.