CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting

  Why it's wrong here

  Cross-site scripting (XSS) is a client-side code injection attack where malicious scripts are injected into trusted websites. While an XSS payload can be used as a vector to steal a user's session cookie (e.g., via `document.cookie`) and transmit it to an attacker, XSS itself is the vulnerability exploitation that enables the theft. The subsequent act of using that stolen session token to impersonate the user is the actual session hijacking, making XSS a means to an end, not the hijacking itself.

• ✓

  Session hijacking

  Why this is correct

  Session hijacking is a sophisticated attack where an attacker successfully obtains a legitimate user's valid session ID or token and then uses it to impersonate that user, gaining unauthorized access to their active session. By presenting the stolen, yet valid, session token to the web server, the attacker effectively bypasses the initial authentication process and can perform actions as if they were the legitimate user. This allows them to take over an already established and authenticated session without needing the user's credentials.

• ✗

  Phishing

  Why it's wrong here

  Phishing is a social engineering technique where attackers attempt to trick users into divulging sensitive information, most commonly login credentials like usernames and passwords, by masquerading as a trustworthy entity. While successful phishing can lead to account compromise, its primary goal is to obtain static authentication factors directly from the user. It does not typically involve the interception or direct theft of an active, dynamic session token to bypass a current session, which distinguishes it from session hijacking.

• ✗

  Brute-force attack

  Why it's wrong here

  A brute-force attack is a systematic method of attempting every possible combination of characters to guess a user's password, encryption key, or other authentication credentials. This attack focuses on discovering the correct authentication factors through exhaustive trial and error, rather than exploiting an active session or stealing an existing session token. It is a direct assault on the authentication mechanism itself, aiming to gain initial access, not to leverage an already established, valid user session.

Go deeper

Related to this question