Question

An attacker somehow obtains an unsuspecting user’s SID and then using it to impersonate the user in order to gain potentially sensitive information. This attack is known as __________

(a) session-fixation

(b) session-fixing

(c) session-hijack

(d) session-copy

I got this question in final exam.

Asked question is from Session Handling-2 topic in chapter File and Session Handling in PHP of PHP

Answer 1

The correct option is (a) session-fixation

To explain I would say: The attack session fixation attempts to exploit the vulnerability of a system that allows one person to set another person’s session identifier. You can minimize this risk by regenerating the session ID on each request while maintaining the session-specific data. PHP offers a convenient function named session_regenerate_id() that will replace the existing ID with a new one.