The process of taking over an existing active session.

The process of taking over an existing active session.

• A. Session Hijacking
• B. Network Level Hijacking
• C. Spoofing Attack
• D. CSRF Attack

Answer: (A)

Taking over an existing active session is session hijacking. It happens when an attacker gains a valid session identifier—usually a session cookie or token—and uses it to access the web application as if they were the legitimate user. Once the attacker can present that token, the server treats their requests as coming from the real account, granting the same level of access. This can occur through several techniques: stealing cookies via cross-site scripting or malware, eavesdropping on unencrypted network traffic to capture tokens, exploiting weak or fixed session IDs (session fixation), or compromising endpoints to extract tokens. To defend against this, use HTTPS everywhere to protect tokens in transit, mark cookies as Secure and HttpOnly to limit access and exposure, regenerate session IDs after login to invalidate old ones, implement SameSite cookie attributes to reduce cross-site request forgery risks, and apply short session timeouts along with multi-factor authentication where appropriate. CSRF, by contrast, tricks a user into performing actions within an active session but doesn’t itself take over the session. Spoofing is broader and can refer to pretending to be someone or something else, not specifically exploiting an existing session token.

Taking over an existing active session is session hijacking. It happens when an attacker gains a valid session identifier—usually a session cookie or token—and uses it to access the web application as if they were the legitimate user. Once the attacker can present that token, the server treats their requests as coming from the real account, granting the same level of access.

This can occur through several techniques: stealing cookies via cross-site scripting or malware, eavesdropping on unencrypted network traffic to capture tokens, exploiting weak or fixed session IDs (session fixation), or compromising endpoints to extract tokens. To defend against this, use HTTPS everywhere to protect tokens in transit, mark cookies as Secure and HttpOnly to limit access and exposure, regenerate session IDs after login to invalidate old ones, implement SameSite cookie attributes to reduce cross-site request forgery risks, and apply short session timeouts along with multi-factor authentication where appropriate.

CSRF, by contrast, tricks a user into performing actions within an active session but doesn’t itself take over the session. Spoofing is broader and can refer to pretending to be someone or something else, not specifically exploiting an existing session token.