312-50 Question 251
Single answer▪ Network-Level Session HijackingDuring an authorized internal assessment, you are connected to the same switched subnet as a user who maintains an active HTTP session to a legacy internal payroll application. The application does not use TLS, and your packet capture shows the server identifies authenticated users only by a session cookie. You have already confirmed you can observe the traffic after positioning yourself as a man-in-the-middle on the local segment. Which action would most directly allow you to take over the user's existing session without knowing their password?
- A
Capture the user's session cookie from the HTTP traffic and replay it in your own requests to the payroll application
- B
Perform a TCP SYN flood against the payroll server so it drops the victim's connection and forces reauthentication
- C
Run a DNS zone transfer against the internal DNS server to discover hidden payroll application records
- D
Use password spraying against the payroll application because session hijacking requires valid credentials even after cookie capture
Show answer and explanation
Correct answer: A
Explanation
This scenario describes classic session hijacking at the network level: the tester is on the same network segment, has achieved visibility into the victim's traffic, and observes a legacy web application using unencrypted HTTP with cookie-based session management. In that situation, the fastest path to hijacking is session token theft and replay, often called cookie hijacking or sidejacking. The core weakness is not just shared network access, but the absence of transport-layer protection and strong session defenses. Industry best practices from sources such as OWASP Session Management guidance and common web security standards emphasize enforcing HTTPS/TLS, marking cookies as Secure and HttpOnly where appropriate, regenerating session IDs after authentication, expiring sessions appropriately, and considering context-aware protections such as device or IP validation. In CEH terms, the candidate should recognize that network-level interception of cleartext session identifiers enables direct impersonation when those identifiers are reused by the server as the sole authenticator.
- A. Correct.
Correct. In a network-level session hijacking scenario involving cleartext HTTP, the most direct method is to capture the authenticated session token, commonly stored in a cookie, and reuse it in requests to impersonate the user. Because the server is relying on the cookie as proof of the authenticated session, replaying that token can allow session takeover if additional controls such as IP binding, reauthentication, token rotation, or TLS protections are absent.
- B. Incorrect.
Incorrect. A TCP SYN flood is a denial-of-service technique, not a session takeover method. While disrupting the victim's connection may affect availability, it does not provide the attacker with the authenticated session state needed to impersonate the user. This option reflects a common misconception that any TCP disruption can be used to hijack a session directly.
- C. Incorrect.
Incorrect. A DNS zone transfer may reveal hostnames or service records if misconfigured, but it does not help take over an already established authenticated HTTP session. The scenario already identifies the target application and confirms observable traffic, so discovering additional DNS information does not address the actual session hijacking objective.
- D. Incorrect.
Incorrect. Password spraying is an authentication attack against user credentials, not a session hijacking technique. If the application trusts an existing session cookie and the attacker has captured that cookie, valid credentials may not be required to access the current session. This distractor targets the misconception that all account compromise scenarios must involve password theft.