312-50 Question 252
Single answer▪ Session Hijacking ToolsDuring an authorized internal penetration test, you are connected to the same switched office LAN as a target user. The user has already authenticated to a legacy web application that still uses HTTP for session management. Your objective is to demonstrate the risk of session hijacking by capturing the victim's active session cookie and reusing it in your browser. Which tool is the most appropriate choice for this task?
- A
Ettercap
- B
Nmap
- C
John the Ripper
- D
Aircrack-ng
Show answer and explanation
Correct answer: A
Explanation
The key detail is that the tester is on the same switched LAN and the application uses HTTP rather than HTTPS for session management. In that situation, session hijacking is commonly demonstrated by placing the attacker in a man-in-the-middle position using ARP poisoning, then sniffing the victim's unencrypted HTTP requests to capture the session cookie. Ettercap is specifically suited for this workflow. By contrast, Nmap handles discovery, John the Ripper handles password cracking, and Aircrack-ng focuses on wireless security assessment rather than being the primary tool for LAN-based HTTP session interception. From a defensive perspective, current best practices are to enforce HTTPS/TLS for all authenticated traffic, mark cookies with Secure and HttpOnly attributes, regenerate session IDs after authentication, and protect against network-layer interception. Guidance consistent with these practices appears in OWASP session management recommendations and general secure web application deployment standards.
- A. Correct.
Correct. Ettercap is a well-known man-in-the-middle and packet-sniffing tool that can perform ARP poisoning on a local switched network, intercept unencrypted HTTP traffic, and capture session cookies for demonstration of session hijacking. In a legacy HTTP environment, this is a practical tool for showing how an attacker on the same LAN could steal and reuse a session token.
- B. Incorrect.
Incorrect. Nmap is primarily a network discovery, port scanning, and service enumeration tool. Although it is valuable during reconnaissance, it is not designed to intercept live session traffic or capture cookies for session hijacking.
- C. Incorrect.
Incorrect. John the Ripper is a password-cracking tool used for offline hash cracking and password auditing. It does not capture live web sessions or perform man-in-the-middle interception of HTTP cookies.
- D. Incorrect.
Incorrect. Aircrack-ng is mainly used for assessing wireless network security, including capturing wireless traffic and attacking weak Wi-Fi encryption implementations. While it may be relevant in wireless attack paths, it is not the most appropriate tool here because the scenario is specifically about hijacking an HTTP session on the same switched LAN, where ARP-based interception with a tool like Ettercap is the direct fit.