An attacker pretends to be another user or machine to gain access. Instead of taking over an existing active session, the attacker initiates a new session using the victim's stolen credentials.

An attacker pretends to be another user or machine to gain access. Instead of taking over an existing active session, the attacker initiates a new session using the victim's stolen credentials.

• A. Trojan
• B. Session Hijacking
• C. Man-in-the-Browser Attack
• D. Spoofing Attack

Answer: (D)

Impersonation of a user or machine to gain access is the defining idea here. The attacker uses stolen credentials to start a new session as the victim, effectively pretending to be that user. That is the essence of a spoofing attack: forging or impersonating an identity to access resources. This differs from session hijacking, which would involve taking over an already active session with a valid session token or cookie rather than starting a fresh session under the victim’s identity. A Trojan is malware that disguises itself as something legitimate to trick a user, and a Man-in-the-Browser attack targets the browser to steal data or alter traffic; neither describes the act of presenting oneself as another user to obtain a new session.

Impersonation of a user or machine to gain access is the defining idea here. The attacker uses stolen credentials to start a new session as the victim, effectively pretending to be that user. That is the essence of a spoofing attack: forging or impersonating an identity to access resources.

This differs from session hijacking, which would involve taking over an already active session with a valid session token or cookie rather than starting a fresh session under the victim’s identity. A Trojan is malware that disguises itself as something legitimate to trick a user, and a Man-in-the-Browser attack targets the browser to steal data or alter traffic; neither describes the act of presenting oneself as another user to obtain a new session.