What is the name of the tactic where the attacker fixes a session by injecting a session ID into the victim's browser?

What is the name of the tactic where the attacker fixes a session by injecting a session ID into the victim's browser?

• A. Session Fixation
• B. Session Donation Attack
• C. Entrance phase
• D. Fixation phase

Answer: (A)

This tactic is known as session fixation. The attacker fixes a session by injecting or delivering a specific session identifier into the victim’s browser before the user logs in. For example, the attacker may provide a link that contains a chosen session ID or cause the browser to accept a pre-set cookie. When the user then authenticates, the server continues using that same session ID, allowing the attacker to hijack the authenticated session by simply using the same ID. This is why it’s critical to rotate or regenerate the session ID after login and to bind sessions to the authenticated user, along with using secure, httpOnly cookies and avoiding URL-based session IDs.

This tactic is known as session fixation. The attacker fixes a session by injecting or delivering a specific session identifier into the victim’s browser before the user logs in. For example, the attacker may provide a link that contains a chosen session ID or cause the browser to accept a pre-set cookie. When the user then authenticates, the server continues using that same session ID, allowing the attacker to hijack the authenticated session by simply using the same ID. This is why it’s critical to rotate or regenerate the session ID after login and to bind sessions to the authenticated user, along with using secure, httpOnly cookies and avoiding URL-based session IDs.