Question

Which of the following BEST describes a TCP session hijacking attack?

answer

An attacker sniffs traffic between the target machine and server and then uses ARP poisoning to redirect communication through the attacker's machine.


An attacker sniffs between two machines on a connection-based protocol, monitors the traffic to capture the session ID, terminates the target computer's connection, and injects packets to the server.


An attacker alters the DNS server to redirect traffic to a malicious website and targets Active Directory or other DNS-reliant networks.


An attacker returns a response to the target before the server does. They do this on a connectionless-based protocol that does not use sequence packets.

Answer 1

Answer: 2

Reason: TCP session hijacking involves sniffing a connection-based protocol (TCP) to learn sequence numbers/session identifiers, then disrupting the legitimate endpoint and injecting packets with the correct sequence numbers to take over the session.