CEH v13 Session Hijacking Practice Questions 2026

Stealing active sessions: session sniffing, session fixation, cookies and tokens, and defenses like HTTPS and re-authentication. Exam focus: sequence prediction, session fixation, and cookie theft are the core trio. Know why HTTPS alone does not stop fixation attacks and which token characteristics — entropy, rotation, binding — actually defeat them.

⚠️ Important Disclaimer: These practice questions are original study material created by CEHStudy for educational purposes. They are NOT EC-Council exam questions and do NOT replicate the actual exam. CEHStudy is not affiliated with or endorsed by EC-Council.

Question 1: Session hijacking is:

A) Resetting another user's password B) Scanning for open ports on a host C) Taking over a valid TCP or web session by stealing or predicting its session identifier D) Forging a TLS certificate

Answer: C — Most authentication happens once at session start — seize the session ID and the server trusts you.

Question 2: The classic phases of TCP session hijacking are:

A) Port scanning, exploiting, patching B) Sniffing, cracking, logging in C) Tracking the connection, desynchronizing it, then injecting packets D) Encrypting, signing, hashing

Answer: C — 1) Track with a sniffer to learn sequence numbers, 2) desync (e.g., RST or null data) so the victim's state drifts, 3) inject attacker packets that the server accepts.

Question 3: Passive session hijacking differs from active hijacking because it:

A) Always requires IP spoofing B) Is completely undetectable by any means C) Only observes and records traffic without disturbing the session D) Uses RST packets to kill connections

Answer: C — Active hijacking takes over the live conversation — desync, spoof, inject — and must win a race against the victim's sequence numbers.

Question 4: In session fixation, the attacker:

A) Steals cookies only after the victim has logged in B) Plants a known session ID (via link or cookie) and waits for the victim to log in with it C) Spoofs the server's certificate to capture passwords D) Brute-forces random session IDs at high speed

Answer: B — If the app doesn't regenerate the ID at login, the attacker's pre-known ID becomes the authenticated session — fix: rotate session ID on authentication.

Question 5: The CRIME attack exploits:

A) Weak hash functions like MD5 B) DNS rebinding in browsers C) TLS/HTTP compression ratio leaks to infer secret data such as cookies D) ARP tables on the local segment

Answer: C — Compression shrinks repeated secrets (cookies) more than random bytes — measuring compressed sizes reveals them. Mitigation: disable TLS compression.

Question 6: Cross-Site Request Forgery (CSRF) works because:

A) Passwords travel in clear text over the network B) The victim's browser automatically attaches session cookies to a forged request the application accepts without verifying its origin C) TLS handshakes are intercepted on-path D) DNS caches never expire

Answer: B — Prevention: per-session anti-CSRF tokens, SameSite cookie attributes, and re-authentication for sensitive actions.

Question 7: A Man-in-the-Browser attack typically:

A) Installs a malicious extension or handler that tampers with form fields in the browser before they are submitted at login B) Steals the KRBTGT account hash from a domain controller C) Floods the target web server with SYN packets D) Cracks the network's WPA pre-shared key

Answer: A — The trojan registers for targeted sites and rewrites DOM field values on submission — the server receives altered data while the user sees normal.

Question 8: RST injection (RST hijacking) is used to:

A) Discover which ports are open B) Capture WPA handshakes C) Forcibly terminate an active session by injecting a spoofed TCP RST packet D) Encrypt traffic between two hosts

Answer: C — A single well-formed RST (correct IP/ports/sequence) tears the connection down — used to desynchronize victims before takeover.

Question 9: In blind session hijacking, the attacker:

A) Has visibility of both client and server traffic B) Exploits only stateless UDP protocols C) Cannot see the server's responses and must predict sequence numbers to inject data D) Uses an on-link sniffer with full visibility

Answer: C — Without seeing replies, the attacker fires candidate packets hoping the predicted sequence number is accepted — low success rate but functional.

Question 10: Which cookie-flag combination best protects against client-side session theft?

A) Setting Path=/ on all cookies B) No flags needed — cookies are safe by default C) Using long cookie expiration times D) Secure + HttpOnly (plus SameSite where supported)

Answer: D — Secure forces HTTPS, HttpOnly blocks document.cookie access via XSS, and SameSite restricts cross-site cookie sending.

Related Glossary Terms

Continue Your CEH v13 Prep

Frequently Asked Questions

How many CEH v13 Session Hijacking practice questions are on this page?

This page includes 10 original multiple-choice practice questions for CEH v13 Module 11 (Session Hijacking). Each question includes a detailed explanation of the correct answer and why the other options are wrong. The full CEHStudy question bank covers all 20 modules with 200+ questions — see the practice hub at https://cehstudy.com/ceh-practice-questions/ for every module.

What does CEH v13 Module 11 (Session Hijacking) cover?

Stealing active sessions: session sniffing, session fixation, cookies and tokens, and defenses like HTTPS and re-authentication. These are the same topics tested under this module on the EC-Council 312-50 exam. Pair this quiz with our free Module 11 flashcards at https://cehstudy.com/ceh-v13/module-11/ to close any gaps.

Are these real CEH exam questions?

No. Every question on CEHStudy is original study material written for exam preparation. They match the style, difficulty, and domain coverage of the actual CEH v13 exam but are not leaked or reproduced EC-Council questions.

How should I use this Session Hijacking quiz for exam prep?

Answer all 10 questions without peeking at explanations, then click "Show My Score". Review every explanation — especially the ones you missed — and re-test those topics with our free CEH flashcards. Aim for 80% or higher on module quizzes before scheduling the exam.

Where do I find CEH Session Hijacking flashcards?

Our free flashcard app covers all 20 CEH v13 modules including Module 11 (Session Hijacking). Visit the CEH flashcards page at https://cehstudy.com/ or the Module 11 page at https://cehstudy.com/ceh-v13/module-11/. No account or sign-up required.

CEH v13 Module 11: Session Hijacking — Free Practice Questions with Explanations