Chapter 49 · Quiz

Replay Attacks Quiz

6 multiple-choice questions and a matching section. Submit to reveal answers and explanations.

Question 1 of 6

What distinguishes a replay attack from an on-path attack?

A. A replay attack requires the attacker to remain positioned between the two communicating parties for the duration of the attack B. A replay attack can only target unencrypted HTTP traffic; on-path attacks work against HTTPS as well C. In a replay attack, the attacker captures legitimate data and retransmits it later without needing the original connection to be active; an on-path attack requires the attacker to remain in the communication path during the live session D. An on-path attack requires physical network access; a replay attack can be performed entirely remotely without any prior data capture

Question 2 of 6

In a pass-the-hash attack, what does the attacker capture and subsequently reuse?

A. A username and the corresponding hashed password — enabling authentication to the server without knowing the plaintext password B. A username and the plaintext password recovered by cracking the hash using a rainbow table or brute-force attack C. A session token issued by the server after successful authentication, allowing the attacker to skip the authentication step entirely D. A digital certificate that the attacker presents to the server to establish a trusted TLS connection as the victim

Question 3 of 6

Which of the following correctly explains why salting (nonce-based authentication) prevents pass-the-hash replay attacks?

A. Salt values encrypt the transmitted hash so that the attacker captures only ciphertext and cannot extract the usable credential B. Each authentication incorporates a unique server-generated nonce, producing a different hash value every time; the server rejects any nonce/hash combination it has already accepted, so a captured hash from a prior authentication cannot be successfully replayed C. Salt values are stored only on the server and never transmitted, so the attacker lacks the information needed to construct a complete authentication request D. Salting forces the client to use HTTPS for authentication traffic, encrypting the hash before it can be captured from the network

Question 4 of 6

What is session hijacking (sidejacking), and why does it succeed even against users who have authenticated with strong passwords and multi-factor authentication?

A. An attack that cracks the user's password by analyzing patterns in captured authentication traffic and statistical properties of the challenge-response B. An attack that forces the server to re-issue a new session ID to the attacker by injecting a malformed authentication request C. An attack where the attacker captures a valid session ID issued after successful authentication and uses it for subsequent requests — the server accepts the session ID as proof of authentication, making the original password and MFA factors irrelevant to the replay D. An attack that modifies the session ID value in transit to escalate the attacker's privileges beyond those of the victim's account

Question 5 of 6

Which tool was specifically designed to automate session cookie capture and one-click session hijacking against users on the same open Wi-Fi network, and what was its primary historical significance?

A. Scapy — a packet manipulation library that constructs forged HTTP requests with stolen session tokens, used by advanced attackers since the early 2000s B. Firesheep — a 2010 Firefox extension that made one-click session hijacking accessible to non-technical users; its widespread adoption demonstrated the real-world impact of HTTP session cookie exposure and accelerated the industry migration to HTTPS-everywhere C. Wireshark — the standard network capture tool, which since version 1.4 included automated cookie extraction and session replay modules D. Tamper — a browser extension that modifies outgoing requests and was widely used before Wireshark added passive capture capabilities

Question 6 of 6

What is the most effective defense against both pass-the-hash and session ID replay attacks conducted over a network?

A. End-to-end encryption (HTTPS/TLS) — if all traffic including authentication exchanges and session cookie transmissions is encrypted, an attacker who captures network packets sees only ciphertext and cannot extract usable hashes or session tokens to replay B. Strong password complexity requirements — making password hashes longer and more computationally expensive to generate prevents the pass-the-hash technique C. Network segmentation — isolating web servers from client workstations on separate subnets prevents all replay attacks by blocking the attacker's capture attempts D. Implementing two-factor authentication — the second factor prevents replay attacks because the attacker would need to capture the second factor value as well

Matching — Replay Attack Concepts

Match each term on the left to its correct description on the right.

1. Replay Attack

2. Pass-the-Hash

3. Session Hijacking

4. Session ID

A. A unique identifier issued by a server after successful authentication, stored in a browser cookie and transmitted with every subsequent request; used to maintain a logged-in session without re-entering credentials

B. A replay attack technique where a captured username and password hash are retransmitted to authenticate as the victim — no plaintext password or hash-cracking required

C. An attack where captured legitimate network data is retransmitted later to impersonate the original sender; does not require the attacker to remain in the communication path during the replay

D. An attack where a valid session token captured from network traffic or a browser cookie is used to access a web server as an authenticated user — without credentials

1 → 2 → 3 → 4 →