Which technique involves injecting an authentic-looking reset (RST) packet using a spoofed source address and predicting the acknowledgment number?

Which technique involves injecting an authentic-looking reset (RST) packet using a spoofed source address and predicting the acknowledgment number?

• A. RST hijacking
• B. DroidSheep
• C. CRIME Attack
• D. Session Hijacking Using Proxy Servers

Answer: (A)

RST hijacking is being tested here. This technique relies on sending a forged TCP reset (RST) segment that appears to come from one of the legitimate endpoints, using a spoofed source address. If the reset segment carries a sequence number that the receiving host considers valid within its current window, the host will accept it and immediately terminate the connection. Predicting or guessing the acknowledgment/sequence number is essential because TCP will ignore a reset with an incorrect number, so the attacker must align the forged packet with the ongoing connection state. By tearing down the session this way, the attacker disrupts or effectively takes control of the affected communication. DroidSheep focuses on capturing web session cookies, not injecting TCP-level resets. The CRIME attack targets TLS compression weaknesses to reveal plaintext data, not TCP connection resets. Session hijacking via proxy servers involves rerouting or intercepting traffic through a proxy, rather than injecting crafted TCP segments to reset a connection.

RST hijacking is being tested here. This technique relies on sending a forged TCP reset (RST) segment that appears to come from one of the legitimate endpoints, using a spoofed source address. If the reset segment carries a sequence number that the receiving host considers valid within its current window, the host will accept it and immediately terminate the connection. Predicting or guessing the acknowledgment/sequence number is essential because TCP will ignore a reset with an incorrect number, so the attacker must align the forged packet with the ongoing connection state. By tearing down the session this way, the attacker disrupts or effectively takes control of the affected communication.

DroidSheep focuses on capturing web session cookies, not injecting TCP-level resets. The CRIME attack targets TLS compression weaknesses to reveal plaintext data, not TCP connection resets. Session hijacking via proxy servers involves rerouting or intercepting traffic through a proxy, rather than injecting crafted TCP segments to reset a connection.