An attack that exploits the victim's active session by predefining or controlling the session ID used during authentication is known as what?

An attack that exploits the victim's active session by predefining or controlling the session ID used during authentication is known as what?

• A. Spoofing Attack
• B. Session Hijacking
• C. Session Fixation Attack
• D. Blind Hijacking

Answer: (C)

Session fixation attacks hinge on the attacker controlling the session identifier that a user will use during authentication. By predefining or predicting a valid session ID and getting the victim to use it, the attacker ensures that once the user logs in, the authenticated session is tied to that known ID. Since the server doesn’t issue a new session after login, the attacker can reuse the same session ID to access the victim’s authenticated session. This differs from session hijacking, where the attacker steals a valid session ID that’s already active to take over an ongoing session. Spoofing is a broader impersonation concept, and the other option doesn’t capture the predefinition and post-login reuse flow.

Session fixation attacks hinge on the attacker controlling the session identifier that a user will use during authentication. By predefining or predicting a valid session ID and getting the victim to use it, the attacker ensures that once the user logs in, the authenticated session is tied to that known ID. Since the server doesn’t issue a new session after login, the attacker can reuse the same session ID to access the victim’s authenticated session. This differs from session hijacking, where the attacker steals a valid session ID that’s already active to take over an ongoing session. Spoofing is a broader impersonation concept, and the other option doesn’t capture the predefinition and post-login reuse flow.