Which attack donates the attacker's own session ID to the target user?

Which attack donates the attacker's own session ID to the target user?

• A. Session Donation Attack
• B. Entrance phase
• C. Fixation phase
• D. Session set-up phase

Answer: (A)

Donating a session ID to the target describes a session fixation style attack. The attacker supplies or forces a specific session identifier for the victim to use before the victim authenticates. The target then ends up with a known session ID, and when the victim logs in, that same ID is used for the authenticated session. The attacker can later reuse that known ID to impersonate the victim. This is precisely what “session donation attack” refers to—the attacker hands over or injects their chosen session ID for the target to adopt, enabling later takeover of the session after authentication. Other terms don’t capture the exact action of giving the victim a known session ID to hijack later.

Donating a session ID to the target describes a session fixation style attack. The attacker supplies or forces a specific session identifier for the victim to use before the victim authenticates. The target then ends up with a known session ID, and when the victim logs in, that same ID is used for the authenticated session. The attacker can later reuse that known ID to impersonate the victim. This is precisely what “session donation attack” refers to—the attacker hands over or injects their chosen session ID for the target to adopt, enabling later takeover of the session after authentication. Other terms don’t capture the exact action of giving the victim a known session ID to hijack later.