Which phase involves the attacker injecting the session ID into the victim's browser to fix the session?

Which phase involves the attacker injecting the session ID into the victim's browser to fix the session?

• A. Session set-up phase
• B. Entrance phase
• C. Fixation phase
• D. DroidSheep

Answer: (C)

Session fixation is about fixing a known session identifier in the victim’s browser before authentication so the attacker can take over the authenticated session later. The attacker injects or induces the victim’s browser to use a specific session ID, and that same ID is then used after the user logs in, allowing the attacker to access the account with that fixed session. This is exactly what the described phase captures: injecting and fixing a session ID in advance so the session is tied to the attacker’s username after login. DroidSheep is a tool used for testing or performing session-related attacks, not a named phase of how a session is fixed. The other terms don’t describe the action of injecting and fixing a session ID, so they don’t fit as well. To guard against this, regenerate the session ID after login, avoid exposing session IDs in URLs, and use secure, HttpOnly, same-site cookies with proper session management.

Session fixation is about fixing a known session identifier in the victim’s browser before authentication so the attacker can take over the authenticated session later. The attacker injects or induces the victim’s browser to use a specific session ID, and that same ID is then used after the user logs in, allowing the attacker to access the account with that fixed session. This is exactly what the described phase captures: injecting and fixing a session ID in advance so the session is tied to the attacker’s username after login.

DroidSheep is a tool used for testing or performing session-related attacks, not a named phase of how a session is fixed. The other terms don’t describe the action of injecting and fixing a session ID, so they don’t fit as well.

To guard against this, regenerate the session ID after login, avoid exposing session IDs in URLs, and use secure, HttpOnly, same-site cookies with proper session management.