312-50 Question 249
Single answer▪ Network-Level Session HijackingDuring an authorized internal assessment, you are connected to the same switched subnet as a legacy web application that still serves authenticated pages over HTTP. A user has already logged in, and your goal is to determine which technique would most reliably let you take over that user's active session at the network layer without knowing their password. Which action is the BEST choice?
- A
Use ARP spoofing to place yourself in the path between the victim and the gateway, capture the session cookie from the unencrypted HTTP traffic, and replay it in your own browser
- B
Perform a TCP SYN flood against the web server so the victim's current session is reset and reassigned to your IP address
- C
Launch a DNS amplification attack so the victim resolves the site to your system and automatically transfers the authenticated session context
- D
Send forged ICMP redirect messages to the victim so the browser discloses the user's password in cleartext during the next request
Show answer and explanation
Correct answer: A
Explanation
The best answer is ARP spoofing followed by interception and reuse of the victim's session cookie. In network-level session hijacking on a local network, the attacker often first gains a man-in-the-middle position using Layer 2 techniques such as ARP poisoning. If the application transmits session identifiers over unencrypted HTTP, those identifiers can be captured and replayed to impersonate the authenticated user without knowing the password. This is why current best practice is to enforce HTTPS everywhere, mark cookies with Secure and HttpOnly attributes, use SameSite where appropriate, regenerate session IDs after authentication, and invalidate sessions properly on logout. These recommendations are consistent with widely accepted guidance such as OWASP Session Management and Transport Layer Protection best practices. The other choices are plausible-sounding network attacks, but they are either DoS-focused or based on misconceptions about how authenticated web sessions are maintained.
- A. Correct.
Correct. In a local switched network, ARP spoofing/ARP poisoning is a classic way to achieve man-in-the-middle positioning between a victim and the default gateway. If the application uses HTTP rather than HTTPS, session identifiers such as cookies can be observed in transit. Replaying a valid session cookie is a practical form of session hijacking because many web applications use the cookie as proof of authentication after login. This directly fits network-level session hijacking in a real assessment.
- B. Incorrect.
Incorrect. A TCP SYN flood is a denial-of-service technique that attempts to exhaust server resources by creating large numbers of half-open connections. It does not transfer an existing authenticated web session to the attacker's IP address. Web sessions are generally tracked through tokens such as cookies, not by simply reassigning connections based on source IP.
- C. Incorrect.
Incorrect. DNS amplification is a reflected distributed denial-of-service technique, not a session hijacking method. Even if DNS manipulation were possible, it would not automatically migrate an authenticated HTTP session to the attacker. Session state is usually maintained by the application through cookies or server-side session records, not by DNS resolution alone.
- D. Incorrect.
Incorrect. ICMP redirects can influence routing behavior in some environments, but they do not inherently cause a browser to reveal stored passwords in cleartext. Modern web authentication flows do not resend plaintext passwords on each request after login; instead, the browser typically sends a session cookie or token. This option confuses credential theft with session hijacking and overstates what ICMP redirects accomplish.