CEH Vulnerability Analysis and System Hacking Practice Question
An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?
⚠ Common exam trap
It's easy for candidates to confuse CSRF with session hijacking, but CSRF does not require reading the cookie—it only requires the browser to automatically include it in requests, whereas XSS-based session hijacking directly steals the cookie value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session hijacking via cross-site scripting (XSS)
The absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection vulnerabilities arise when an application constructs SQL queries using unsanitized user input, allowing an attacker to manipulate the database logic. While an attacker might indirectly retrieve session IDs stored in a database via SQLi, the attack vector itself targets the database server to execute arbitrary commands or extract data, not the client-side session cookie directly from the user's browser. It's a server-side attack on data integrity and confidentiality, distinct from client-side cookie manipulation.
- ✗
Cross-site request forgery (CSRF)
Why it's wrong here
Cross-site request forgery (CSRF) exploits the trust a web application has in a user's browser, tricking an authenticated user into unknowingly executing unwanted actions on a trusted site. The attack leverages the browser's automatic inclusion of session cookies with requests to the target domain, but the attacker never directly accesses or steals the user's session cookie. Instead, the user's browser sends the cookie along with the forged request, making the action appear legitimate to the server.
- ✓
Session hijacking via cross-site scripting (XSS)
Why this is correct
Session hijacking via Cross-Site Scripting (XSS) occurs when an attacker injects malicious client-side scripts into a web page viewed by other users. If the session cookie lacks the HttpOnly flag, the injected script can access document.cookie to read and exfiltrate the victim's session identifier. With the stolen session cookie, the attacker can then impersonate the victim, gaining unauthorized access to their authenticated session without needing their credentials. This directly targets the client-side session token.
- ✗
Clickjacking
Why it's wrong here
Clickjacking, also known as UI redressing, involves layering a transparent malicious iframe over a legitimate web page, tricking users into clicking hidden elements on the underlying page. The user believes they are interacting with the visible, benign content, but their clicks are actually directed to the concealed malicious content. This attack primarily aims to induce unintended user actions, such as making purchases or changing settings, rather than directly stealing session cookies or hijacking an existing session.
Go deeper
Related to this question
Learn chapter
Introduction to Ethical Hacking
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.