Discussion
Consider the following statements in the context of session hijacking.
(i) It is compromising a user's session to exploit their data and perform malicious activities or misusing their credentials.
(ii) The most common method of session hijacking is IP spoofing where the attacker acts as one of the authenticated users.
(iii) Session hijacking can be prevented by using packet sniffers and cross site scripting.
(iv) To protect the network with session hijacking, the defender has to implement security measures at Application as well as Network level.
Which of the statement(s) given above is/are correct ?
Answer: C
Statements (i), (ii) and (iv) are accepted, so the answer is (i), (ii) and (iv) only.
Session hijacking means taking over a user's authenticated session, usually by stealing the session token, to access their data or act in their name (i). The key accepts IP spoofing, where the attacker forges the address of an authenticated host to slip into its connection, as a common method (ii). Defence has to be layered: encryption and secure session handling in the application, and filtering and monitoring at the network level (iv).
Statement (iii) is wrong: packet sniffing and cross-site scripting are ways attackers steal session tokens, not ways to prevent hijacking. That rules out 'all the above' and option B, and option D leaves out the true statement (iv).
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development