Identifying RST Hijacking via Spoofed Reset Packets

312-50v12 By islever Editorial Last updated

Session Hijacking

Short answer

C The attacker used RST hijacking by injecting a spoofed reset packet to terminate the victim's TCP connection.

Question

A security analyst is investigating a potential network-level session hijacking incident. During the investigation, the analyst finds that the attacker has been using a technique in which they injected an authentic-looking reset packet using a spoofed source IP address and a guessed acknowledgment number. As a result, the victim's connection was reset. Which of the following hijacking techniques has the attacker most likely used?
  1. Blind hijacking
  2. UDP hijacking
  3. RST hijacking Correct Answer
  4. TCP/IP hijacking

Key Takeaways

The key insight is distinguishing between hijacking types based on the packet action; injecting a reset packet (RST) defines RST hijacking, regardless of whether the sequence number was guessed or predicted.

This question tests the identification of session hijacking techniques, specifically focusing on TCP connection termination. The correct answer is C because the attacker injected a spoofed RST packet to reset the victim's connection.

Common mistake: Learners often select 'Blind hijacking' (A) because the prompt mentions 'guessed acknowledgment number,' confusing the method of prediction with the specific technique of sending a reset packet.

Expert Analysis

Why the Answer Is Correct

The attacker's action of injecting an authentic-looking reset packet using a spoofed source IP and a guessed acknowledgment number is the textbook definition of RST hijacking. This technique forces the termination of an active TCP session by convincing both endpoints that a reset originated from the legitimate peer.

Why the Other Options Are Wrong

UDP hijacking (B) is incorrect because UDP is connectionless and does not use acknowledgment numbers or reset packets in this manner. TCP/IP hijacking (D) is a broad category, but RST hijacking is the specific mechanism described. Blind hijacking (A) refers to hijacking without seeing the traffic, which often involves guessing sequence numbers, but the defining feature here is the injection of the RST packet itself.

Community Comment Notes

Community consensus strongly supports option C, with users citing the CEH v12 textbook module on Session Hijacking. Comments emphasize that the act of injecting a reset packet is the primary identifier for RST hijacking, clarifying that the 'guessing' aspect relates to the blind nature of the attack rather than changing the technique name.

Exam Strategy

When analyzing session hijacking questions, focus on the specific packet type injected (e.g., SYN, ACK, RST) and the resulting action (connection established vs. terminated). If the goal is to kill the session, look for RST hijacking.

Frequently Asked Questions

Why isn't this considered Blind Hijacking?

While blind hijacking involves guessing sequence numbers, the specific technique of injecting a reset packet to kill the session is classified as RST hijacking.

Can RST hijacking work if the ACK number is wrong?

No, the reset packet must contain a valid acknowledgment number within the window to be accepted by the victim's TCP stack.

More 312-50v12 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. przemyslaw1 👍 3 Answered C
    RST hijacking involves injecting an authentic-looking reset (RST) packet using spoofed source address and predicting the acknowledgment number.
  2. insaniunt 👍 2 Answered C
    module 11 page 1562 from CEH v12 book
  3. Nopez 👍 1
    RST Hijacking RST hijacking involves injecting an authentic-looking reset (RST) packet using spoofed source address and predicting the acknowledgment number. The hacker can reset the victim's connection if it uses an accurate acknowledgement number. The victim believes that the source actually sent the reset packet and resets the connection. RST Hijacking can be carried out using a packet crafting tool such as Colasoft's Packet Builder and TCP/IP analysis tool such as tcpdump.
  4. blehbleh 👍 1 Answered A
    Fairly certain this is A as it states in the questions "guessed acknowledgment number" so if the attacker guessed the acknowledgment number and is trying to inject an RST packet to reset the connection and was successful then the outcome would still be the same. I really feel like since the posted in the question that it was guessed it should eliminate any of other options but they put in the RST hijacking to try and throw people off.
  5. agelbahri 👍 1 Answered C
    RST hijacking involves injecting an authentic-looking reset (RST) packet by using a spoofed source IP address and predicting the acknowledgment number.
Show 1 more comment
  1. xbsumz 👍 1
    Team can you confirm if this is accurate

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide