Which phase involves the attacker obtaining a legitimate session ID by establishing a connection with the target web server?

Which phase involves the attacker obtaining a legitimate session ID by establishing a connection with the target web server?

• A. Fixation phase
• B. Session set-up phase
• C. Entrance phase
• D. Session Hijacking Using Proxy Servers

Answer: (B)

The phase being tested is the moment when a new web session is created and the server issues a session ID. When a client connects to the target web server to start a session, the server generates a legitimate session ID (often stored in a cookie). If an attacker can establish that connection and obtain that ID, they gain a valid token to impersonate the user later. This is precisely the session set-up phase, the point at which a real session ID is created and handed out by the server. The other terms don’t fit as well. Session fixation would involve forcing a known session ID onto a user before they start the session, rather than the attacker obtaining a fresh ID during initial connection. The entrance phase and the phrasing around proxy-based hijacking describe different ideas or tools rather than the specific moment of session creation and ID issuance.

The phase being tested is the moment when a new web session is created and the server issues a session ID. When a client connects to the target web server to start a session, the server generates a legitimate session ID (often stored in a cookie). If an attacker can establish that connection and obtain that ID, they gain a valid token to impersonate the user later. This is precisely the session set-up phase, the point at which a real session ID is created and handed out by the server.

The other terms don’t fit as well. Session fixation would involve forcing a known session ID onto a user before they start the session, rather than the attacker obtaining a fresh ID during initial connection. The entrance phase and the phrasing around proxy-based hijacking describe different ideas or tools rather than the specific moment of session creation and ID issuance.