Ethical Hacking Essentials Practice Test

Which type of keys should be used to protect against session hijacking?

1. Short predictable strings

2. Strings or long random numbers

3. Fixed session identifiers

4. Hash values

The correct answer is: Strings or long random numbers

Using strings or long random numbers is the most effective method to protect against session hijacking. This approach enhances security because long random keys significantly increase the complexity and unpredictability of session identifiers. When these keys are sufficiently random, they become extremely difficult for attackers to guess or brute-force, thus reducing the likelihood of session hijacking. In contrast, short predictable strings are easy for attackers to guess or predict, leading to a vulnerability in session management. Fixed session identifiers can also pose a risk as they do not change throughout a session, allowing an attacker who has accessed the identifier to maintain control over the session. Hash values, while beneficial in verifying data integrity, do not inherently provide a secure method for session management because they can still be brute-forced if not implemented properly and do not account for session state changes. Therefore, incorporating long and random session keys is a robust defense against session hijacking.