CEH Practice Question: Malware, Social Engineering and Network Attacks
An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?
⚠ Common exam trap
Many exam-takers confuse session hijacking with a generic man-in-the-middle attack, but the key differentiator is the specific act of predicting TCP sequence numbers to inject packets, which is a hallmark of session hijacking, not just passive interception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session hijacking
The attacker is actively intercepting a TCP session, predicting sequence numbers, and injecting malicious packets, which is the definition of TCP session hijacking. This attack exploits the lack of authentication in TCP connections, where the attacker can take over an established session by correctly guessing or obtaining the next sequence number.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing is an attack where an attacker injects forged DNS records into a DNS resolver's cache or directly responds to DNS queries, redirecting legitimate domain names to a malicious IP address controlled by the attacker. This manipulation primarily affects the initial connection setup by sending clients to the wrong server, but it does not involve intercepting an already established TCP session or predicting its sequence numbers to take control. Its impact is on name resolution, not active session state.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning, or ARP spoofing, involves an attacker sending forged Address Resolution Protocol (ARP) messages onto a local area network. This causes the attacker's MAC address to be associated with the IP address of another host, such as the default gateway, redirecting network traffic through the attacker's machine. While it enables traffic interception, ARP poisoning itself does not directly involve the prediction or manipulation of TCP sequence numbers to hijack an existing session; it operates at Layer 2 to reroute packets.
- ✗
Man-in-the-middle
Why it's wrong here
A Man-in-the-Middle (MITM) attack describes a general scenario where an attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. While session hijacking can be a technique employed within an MITM attack, MITM itself is a broader attack posture or positioning. It does not specifically define the method of predicting TCP sequence numbers to seize control of an established session, but rather the intermediary role of the attacker.
- ✓
Session hijacking
Why this is correct
Session hijacking is the act of taking control of an already authenticated TCP session between two communicating parties. This is typically achieved by an attacker successfully predicting or sniffing the correct TCP sequence numbers (acknowledgment and sequence numbers) that the legitimate client and server expect. By injecting packets with the correct sequence numbers, the attacker can impersonate the client or server, effectively taking over the session and issuing commands or receiving data without the original client's knowledge.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.