Application Level Session Hijacking

Question 1

Explain MITM/Sniffing Attacks

Answer 1

Identifying session tokens, IDs, username, and/or passwords from network traffic

Question 2

Explain MITB Attacks

Answer 2

Man-in-the-Browser attack takes over browser settings to manipulate the information

Question 3

Cross-Site Scripting Attack Types

Answer 3

Reflected
DOM-Based
Stored/Persistent

Question 4

Explain Cross-Site Scripting Reflected Attacks

Answer 4

Insecure input fields which execute code “reflected” back to the user

Question 5

Explain Cross-Site Scripting Stored/Persistent Attacks

Answer 5

Create malicious script on browser which executes upon a user visiting the page

Question 6

CRIME Attack Vulnerable Protocols

Answer 6

HTTPS
SSL
TLS
Speedy

Question 7

Define CRIME attack

Answer 7

Compression Ratio Info-leak Made Easy

Question 8

Explain Fixation/Donation Attacks

Answer 8

Including a session token in the url link to the web application

Question 9

Explain Cross-Site Requests Forgery Attacks

Answer 9

Utilizes open sessions in a user’s web browser to execute scripts

Question 10

Explain Session ID Prediction Attacks

Answer 10

Guess the web application session ID.