Lakia has been hired as a penetration tester for a large organization. She finds that one of the branch offices is still running WEP and quickly cracks the key to gain access to the network. As she is capturing network packets while sitting in the company's parking lot, she sees a couple of tokens that users send to an HTTP-based website to log in. Which of the following types of attacks might she be able to perform with this information?
A) XSS
B) Session hijacking
C) XSRF
D) Rootkit attack

Question

Quizplus · Accepted Answer

Lakia can perform session hijacking with the information she has obtained. By capturing tokens that users send to an HTTP-based website to log in, she can use these tokens to impersonate the users on the network, effectively hijacking their sessions. This type of attack exploits the session token management vulnerability, allowing the attacker to gain unauthorized access to the user's account and associated privileges on the web application.

Lakia Has Been Hired as a Penetration Tester for a Large