An attacker tricks a user into interacting with a legitimate web server using an explicit session ID value. What is this attack called?

An attacker tricks a user into interacting with a legitimate web server using an explicit session ID value. What is this attack called?

• A. Hidden Field Manipulation
• B. CAPTCHA
• C. Session Fixation Attack
• D. Cookies

Answer: (C)

Session fixation is the act of getting a user to adopt a known session identifier that the attacker controls or can predict. In this scenario, the user is induced to interact with a legitimate web server using a specific session ID value. The server creates or maintains that session, and the user authenticates while that fixed session ID is in use. Once authentication succeeds, the attacker already knows the session ID and can reuse it to access the authenticated session, effectively hijacking the account. Understand that this hinges on not changing the session identifier at or after login. If the server issues a new, fresh session ID during authentication (session ID regeneration) and binds the login to that new ID, the attack is blocked. Using secure cookies (HttpOnly, Secure), avoiding session IDs in URLs, and proper session invalidation after logout also help prevent this class of attack. Hidden Field Manipulation involves tampering with hidden form fields, CAPTCHA is a bot-detection mechanism, and Cookies are general data stored by the browser—they don’t describe the attack pattern by themselves.

Session fixation is the act of getting a user to adopt a known session identifier that the attacker controls or can predict. In this scenario, the user is induced to interact with a legitimate web server using a specific session ID value. The server creates or maintains that session, and the user authenticates while that fixed session ID is in use. Once authentication succeeds, the attacker already knows the session ID and can reuse it to access the authenticated session, effectively hijacking the account.

Understand that this hinges on not changing the session identifier at or after login. If the server issues a new, fresh session ID during authentication (session ID regeneration) and binds the login to that new ID, the attack is blocked. Using secure cookies (HttpOnly, Secure), avoiding session IDs in URLs, and proper session invalidation after logout also help prevent this class of attack.

Hidden Field Manipulation involves tampering with hidden form fields, CAPTCHA is a bot-detection mechanism, and Cookies are general data stored by the browser—they don’t describe the attack pattern by themselves.