Which Three Techniques are Used in Session Hijacking?
Which THREE of the following are techniques used in session hijacking? (Select three.)
Quick Answer
The answer is cookie theft, along with TCP sequence prediction and ARP poisoning. Cookie theft allows an attacker to steal a valid session token, often through cross-site scripting, and use it to impersonate a legitimate user. TCP sequence prediction exploits the ability to guess or calculate the sequence numbers in a TCP connection, enabling the injection of malicious packets to hijack an active session. ARP poisoning corrupts the local Address Resolution Protocol cache, placing the attacker in a man-in-the-middle position to intercept and take over the session traffic. On the Certified Ethical Hacker CEH exam, this question tests your understanding of network-level and application-level hijacking vectors; a common trap is confusing session hijacking with session fixation or brute-forcing. Remember the mnemonic “CAT” for Cookie theft, ARP poisoning, and TCP sequence prediction to lock in the three core techniques.
⚠ Common exam trap
Watch out — candidates often confuse network reconnaissance or DoS techniques (like DNS amplification or MAC flooding) with active session hijacking methods, which require direct manipulation of session tokens or TCP state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning
ARP poisoning (A) is correct because an attacker poisons the victim's ARP cache to map the gateway's IP to the attacker's MAC address, enabling a man-in-the-middle position where the attacker can capture or reuse the victim's session ID. TCP sequence prediction (C) is correct because hijacking a TCP session requires guessing the next expected sequence and acknowledgment numbers so the attacker can inject packets that the server accepts as belonging to the legitimate session. Cookie theft (D) is correct because session cookies often carry the session identifier, and stealing them (via XSS, sniffing, or malware) lets the attacker replay the cookie and impersonate the authenticated user. DNS amplification (B) is not a session hijacking technique; it is a reflection/amplification DoS attack that abuses open DNS resolvers to flood a target with large responses. MAC flooding (E) is a Layer 2 switch attack that overflows the CAM table to force the switch into hub-like flooding, which can aid sniffing but is not itself a session hijacking technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP poisoning
Why this is correct
ARP poisoning redirects traffic through the attacker by forging ARP replies, enabling interception of an established session's packets. It is a network-level session hijacking technique because it positions the attacker inline to steal or take over the victim's TCP session.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a reflection-based volumetric DDoS technique that spoofs source addresses to overwhelm a target; it never captures or reuses a victim's session identifier. It is tempting because it involves spoofing, but session hijacking needs token theft or prediction, not amplified DNS responses.
- ✓
TCP sequence prediction
Why this is correct
TCP sequence prediction lets an attacker forge packets matching the victim's expected sequence and acknowledgement numbers, injecting data into an established session without seeing every packet. It is a classic session hijacking technique exploiting predictable initial sequence numbers.
- ✓
Cookie theft
Why this is correct
Cookie theft captures the victim's session token, typically via XSS or sniffing, then replays it to impersonate the authenticated user. It hijacks the session at the application layer, satisfying the stem's requirement for a session hijacking technique.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overflows a switch's CAM table so traffic is broadcast to all ports, enabling sniffing; it does not take over an established session. It is tempting because it is a layer-2 attack that can precede hijacking, but session hijacking requires stealing or predicting a valid session token, not flooding forwarding tables.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Session Hijacking
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid techniques for session hijacking? (Select 2)
medium- A.DNS spoofing
- B.MAC flooding
- ✓ C.TCP sequence prediction
- ✓ D.Cookie theft
- E.ARP poisoning
Why C: TCP sequence prediction (C) is a valid session hijacking technique because an attacker who can guess or infer the next expected TCP sequence and acknowledgment numbers can inject forged packets into an established TCP session, impersonating the legitimate client without ever seeing the authentication exchange. Cookie theft (D) is also valid because session cookies often serve as the bearer token for an authenticated HTTP session, so stealing a cookie (via XSS, sniffing, or malware) lets the attacker replay it and take over the victim's session. DNS spoofing (A), MAC flooding (B), and ARP poisoning (E) are not session hijacking techniques themselves: DNS spoofing redirects name resolution, MAC flooding overflows a switch's CAM table to force hub-like flooding, and ARP poisoning enables man-in-the-middle traffic interception — each may facilitate an attack, but none directly hijacks an existing session.
Variation 2. Which THREE of the following are techniques used in session hijacking?
hard- A.DNS cache poisoning
- ✓ B.Man-in-the-middle (MITM) interception
- C.MAC flooding
- ✓ D.Cookie theft and replay
- ✓ E.TCP sequence number prediction
Why B: Session hijacking is the takeover of an established, authenticated session, and MITM interception (B) is a core technique because an attacker positioned between client and server can capture the session token or cookie as it traverses the network and then impersonate the victim. Cookie theft and replay (D) is correct because session cookies are the credential that identifies an authenticated session; stealing one (e.g., via XSS or sniffing) and replaying it lets the attacker assume the victim's authenticated state without knowing the password. TCP sequence number prediction (E) is correct because TCP session hijacking works by guessing or sniffing the next expected sequence/acknowledgment numbers so the attacker can inject packets into an already-established TCP connection and desynchronize the legitimate client. DNS cache poisoning (A) is not a session hijacking technique; it corrupts name resolution to redirect users to malicious hosts, which is a redirection/spoofing attack rather than takeover of an existing session. MAC flooding (C) is a Layer 2 switch attack that overflows the CAM table to force hub-like flooding, enabling sniffing but not itself hijacking a session.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.