Question 1

Describe the reason why an ACK storm happens.

Accepted Answer

The ACK storm happens because the attacker was not in a place to stop or delete packets the trusted computer sent. An ACK storm will not occur if the attacker can place himself in the actual flow of the packets, but it takes a certain amount of daring to set up the situation so that you can put yourself in the flow. The attacker would have to be in control of the connection itself so that the session authentication takes place through the attacker's chosen channel.

Question 2

_________________________ occurs when a hacker takes control of a TCP session between two hosts.

Accepted Answer

TCP session hijacking

Question 3

Describe the three-way handshake authentication method of TCP.

Accepted Answer

In the three-way handshake authentication method of TCP, a SYN packet is sent to the server by the client in order to initiate a connection. Then the server sends a SYN/ACK packet as an acknowledgment that the synchronization request by the client has been received, and awaits the final step. The client sends an ACK packet to the server. At this point, both the client and the server are ready to transmit and receive data. The connection ends with an exchange of Finish packets (FIN), or Reset packets (RST).

Question 4

A TCP connection can be broken either by exchanging the FIN packets or by sending ____ packets.

Accepted Answer

A) ACK 
B) END 
C) STP 
D) RST 
A) ACK 
B) END 
C) STP 
D) RST

Question 5

A(n) ____ on a computer stores the IP address and the corresponding MAC address.

Accepted Answer

A) IP table 
B) TCP table 
C) UDP table 
D) ARP table 
A) IP table 
B) TCP table 
C) UDP table 
D) ARP table

Question 6

TCP works with ____ to manage data packets on the network.

Accepted Answer

A) IP 
B) FIN 
C) ARP 
D) SSH 
A) IP 
B) FIN 
C) ARP 
D) SSH

Question 7

A route table has two sections: the active routes and the ____.

Accepted Answer

A) close routes 
B) active connections 
C) alternate routes 
D) passive routes 
A) close routes 
B) active connections 
C) alternate routes 
D) passive routes

Question 8

A TCP session can be hijacked only before the hosts have authenticated successfully.

Accepted Answer

A) True 
 B)False

Question 9

____________________ is a debugging technique that allows packets to explicitly state the route they will follow to their destination rather than follow normal routing rules.

Accepted Answer

The answer of ____________________ is a debugging technique that allows...

Question 10

____________________ was developed by Pavel Krauz, inspired by Juggernaut, another session hijacking tool.

Accepted Answer

The answer of ____________________ was developed by Pavel Krauz, inspired...

Question 11

Since UDP does not have many error recovery features, it is more resistant to hijacking.

Accepted Answer

A) True 
 B)False

Question 12

____ solves the ACK storm issue and facilitates TCP session hijacking.

Accepted Answer

A) SSL 
B) Storm watching 
C) Packet blocking 
D) Encryption 
A) SSL 
B) Storm watching 
C) Packet blocking 
D) Encryption

Question 13

A successful hijacking takes place when a hacker intervenes in a TCP conversation and then takes the role of either host or recipient.

Accepted Answer

A) True 
 B)False

Question 14

A(n) ____________________ shows the way to the address sought, or the way to the nearest source that might know the address.

Accepted Answer

The answer of A(n) ____________________ shows the way to the...

Question 15

Hunt performs sniffing in addition to session hijacking.

Accepted Answer

A) True 
 B)False

Question 16

How can you stop a continuous ACK transfer by resynchronizing the client and server?

Accepted Answer

Resynchronizing the actual trusted compu

Question 17

____________________ refers to setting an IDS rule to watch for abnormal increases in network traffic and to alert the security officer when they occur.

Accepted Answer

The answer of ____________________ refers to setting an IDS rule...

Question 18

Hijacking differs from spoofing in that the takeover occurs during an authenticated session.

Accepted Answer

A) True 
 B)False

Describe the reason why an ACK storm happens.

_________________________ occurs when a hacker takes control of a TCP session between two hosts.

Describe the three-way handshake authentication method of TCP.

A TCP connection can be broken either by exchanging the FIN packets or by sending ____ packets.

A(n) ____ on a computer stores the IP address and the corresponding MAC address.

TCP works with ____ to manage data packets on the network.

A route table has two sections: the active routes and the ____.

A TCP session can be hijacked only before the hosts have authenticated successfully.

____________________ is a debugging technique that allows packets to explicitly state the route they will follow to their destination rather than follow normal routing rules.

____________________ was developed by Pavel Krauz, inspired by Juggernaut, another session hijacking tool.

Since UDP does not have many error recovery features, it is more resistant to hijacking.

____ solves the ACK storm issue and facilitates TCP session hijacking.

A successful hijacking takes place when a hacker intervenes in a TCP conversation and then takes the role of either host or recipient.

A(n) ____________________ shows the way to the address sought, or the way to the nearest source that might know the address.

Hunt performs sniffing in addition to session hijacking.

How can you stop a continuous ACK transfer by resynchronizing the client and server?

____________________ refers to setting an IDS rule to watch for abnormal increases in network traffic and to alert the security officer when they occur.

Hijacking differs from spoofing in that the takeover occurs during an authenticated session.

Ethics of Hacking and Cracking

Reconnaissance

Scanning Tools

Sniffers

TCP/IP Vulnerabilities

Encryption and Password Cracking

Spoofing

Hacking Network Devices

Trojan Horses

Denial-Of-Service Attacks

Buffer Overflows

Programming Exploits

Mail Vulnerabilities

Web Application Vulnerabilities

Windows Vulnerabilities

Unix/Linux Vulnerabilities

Incident Handling

Filters

Exam 8: Session Hijacking

Describe the reason why an ACK storm happens.

_________________________ occurs when a hacker takes control of a TCP session between two hosts.

Describe the three-way handshake authentication method of TCP.

A TCP connection can be broken either by exchanging the FIN packets or by sending ____ packets.

A(n) ____ on a computer stores the IP address and the corresponding MAC address.

TCP works with ____ to manage data packets on the network.

A route table has two sections: the active routes and the ____.

A TCP session can be hijacked only before the hosts have authenticated successfully.

____________________ is a debugging technique that allows packets to explicitly state the route they will follow to their destination rather than follow normal routing rules.

____________________ was developed by Pavel Krauz, inspired by Juggernaut, another session hijacking tool.

Since UDP does not have many error recovery features, it is more resistant to hijacking.

____ solves the ACK storm issue and facilitates TCP session hijacking.

A successful hijacking takes place when a hacker intervenes in a TCP conversation and then takes the role of either host or recipient.

A(n) ____________________ shows the way to the address sought, or the way to the nearest source that might know the address.

Hunt performs sniffing in addition to session hijacking.

How can you stop a continuous ACK transfer by resynchronizing the client and server?

____________________ refers to setting an IDS rule to watch for abnormal increases in network traffic and to alert the security officer when they occur.

Hijacking differs from spoofing in that the takeover occurs during an authenticated session.

Ethics of Hacking and Cracking

Reconnaissance

Scanning Tools

Sniffers

TCP/IP Vulnerabilities

Encryption and Password Cracking

Spoofing

Hacking Network Devices

Trojan Horses

Denial-Of-Service Attacks

Buffer Overflows

Programming Exploits

Mail Vulnerabilities

Web Application Vulnerabilities

Windows Vulnerabilities

Unix/Linux Vulnerabilities

Incident Handling

Filters