312-50 Question 253
Single answer▪ Session Hijacking ToolsDuring an authorized internal assessment, you are connected to the same switched network segment as several employee workstations. The target web application still allows authenticated access over plain HTTP for some legacy pages and uses a session cookie to maintain login state. You want to demonstrate the risk of session hijacking by capturing a user's active web session and replaying it in your own browser. Which tool is the most appropriate for this task?
- A
Ettercap
- B
sqlmap
- C
John the Ripper
- D
Nmap
Show answer and explanation
Correct answer: A
Explanation
This scenario focuses on practical session hijacking over an internal network where HTTP traffic is still present. In such environments, an attacker or tester commonly uses a man-in-the-middle technique such as ARP spoofing/poisoning to observe unencrypted traffic and capture session identifiers. Ettercap is appropriate because it supports MITM attacks and packet capture on local networks, making it relevant to session hijacking demonstrations in CEH-style scenarios. By contrast, sqlmap targets SQL injection, John the Ripper targets password cracking, and Nmap targets reconnaissance. From a defensive perspective, best practices include enforcing HTTPS everywhere, setting Secure and HttpOnly cookie attributes, using HSTS, regenerating session IDs after authentication, and monitoring for ARP spoofing. These recommendations align with common web security guidance such as OWASP Session Management best practices and general vendor guidance on protecting session cookies and transport security.
- A. Correct.
Correct. Ettercap is a well-known man-in-the-middle and packet-sniffing tool that can perform ARP poisoning on a LAN, capture traffic, and help obtain session cookies from unencrypted HTTP traffic. In a scenario where the tester is on the same switched network and wants to intercept and replay a web session, Ettercap is an appropriate session hijacking tool.
- B. Incorrect.
Incorrect. sqlmap is used to detect and exploit SQL injection vulnerabilities in web applications. Although it interacts with web sessions and can use cookies during testing, it is not a session hijacking tool for intercepting another user's active session on the network.
- C. Incorrect.
Incorrect. John the Ripper is a password-cracking tool used to crack password hashes or test password strength. It does not capture network traffic or hijack web sessions. A candidate might choose it because authentication is involved, but the scenario is about stealing an existing session, not recovering credentials.
- D. Incorrect.
Incorrect. Nmap is primarily a network discovery and port-scanning tool. While it can identify hosts, services, and some web-related information through NSE scripts, it is not designed to intercept traffic or hijack authenticated web sessions.