312-50 Question 250
Single answer▪ Network-Level Session HijackingDuring an authorized internal security assessment, you are connected to the same switched subnet as a legacy web application used by employees over unencrypted HTTP. After a user logs in successfully, you observe that the application relies only on a session cookie for authentication. You want to demonstrate network-level session hijacking without knowing the user's password and with minimal disruption to the target environment. Which action is the MOST appropriate to achieve this goal?
- A
Poison the local network with ARP spoofing to position yourself as a man-in-the-middle, capture the victim's HTTP session cookie, and replay it in your own browser
- B
Launch a TCP SYN flood against the web server so existing sessions are dropped, then reconnect using the victim's username
- C
Perform DNS cache poisoning on the enterprise resolver so the victim is redirected to a cloned login page and enters credentials
- D
Crack the web server's TLS private key and decrypt the user's session traffic offline
Show answer and explanation
Correct answer: A
Explanation
The key clue is that the application uses unencrypted HTTP and authenticates users through a session cookie. In that situation, an attacker on the same network segment can use a man-in-the-middle technique such as ARP spoofing to intercept traffic on a switched LAN. Once the session cookie is captured, replaying it in another browser or tool can hijack the authenticated session because the cookie acts as a bearer token. This is a textbook example of network-level session hijacking.
The other options test common misconceptions. SYN flooding affects availability, not confidentiality or session takeover. DNS poisoning with a cloned site is closer to credential harvesting than session hijacking. Cracking TLS keys is both impractical and unrelated here because the scenario explicitly involves HTTP rather than HTTPS.
From a best-practice perspective, defenses include enforcing HTTPS everywhere, setting Secure and HttpOnly cookie attributes, regenerating session IDs after authentication, using short session lifetimes, and implementing protections against man-in-the-middle attacks such as Dynamic ARP Inspection, DHCP snooping, and network segmentation. Guidance on protecting session identifiers and transport security aligns with OWASP Session Management recommendations and standard enterprise network hardening practices.
- A. Correct.
Correct. This is a classic and realistic network-level session hijacking approach on a local LAN when traffic is unencrypted. ARP spoofing can place the tester in a man-in-the-middle position on a switched network, allowing interception of HTTP traffic. If the application uses a session cookie as the sole bearer token, capturing and replaying that cookie can let the tester assume the victim's authenticated session without needing the password. This directly matches the goal of demonstrating session hijacking with minimal disruption.
- B. Incorrect.
Incorrect. A TCP SYN flood is a denial-of-service technique, not a session hijacking method. It disrupts availability and is not an appropriate or minimally disruptive way to take over an authenticated user's existing session. It also would not provide the victim's valid session token.
- C. Incorrect.
Incorrect. DNS cache poisoning followed by a fake login page is a credential theft/phishing scenario, not network-level session hijacking of an already established session. It aims to harvest credentials rather than hijack the current authenticated session token already in use.
- D. Incorrect.
Incorrect. This is not a practical or realistic action in a standard internal assessment scenario. Modern TLS is specifically designed to prevent passive decryption without access to server keys and, even with server private keys, forward secrecy ciphersuites commonly prevent decryption of previously captured sessions. Also, the scenario explicitly states the application is using unencrypted HTTP, making this option irrelevant.