Identifying RST Hijacking via Spoofed Reset Packets
A security analyst is investigating a potential network-level session hijacking incident. During the investigation, the analyst finds that the attacker has been using a technique in which they injected an authentic-looking reset packet using a spoofed source IP address and a guessed acknowledgment number. As a result, the victim's connection was reset. Which of the following hijacking techniques has the attacker most likely used?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key insight is distinguishing between hijacking types based on the packet action; injecting a reset packet (RST) defines RST hijacking, regardless of whether the sequence number was guessed or predicted.
This question tests the identification of session hijacking techniques, specifically focusing on TCP connection termination. The correct answer is C because the attacker injected a spoofed RST packet to reset the victim's connection.
Learners often select 'Blind hijacking' (A) because the prompt mentions 'guessed acknowledgment number,' confusing the method of prediction with the specific technique of sending a reset packet.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The attacker's action of injecting an authentic-looking reset packet using a spoofed source IP and a guessed acknowledgment number is the textbook definition of RST hijacking. This technique forces the termination of an active TCP session by convincing both endpoints that a reset originated from the legitimate peer.Why the Other Options Are Wrong
UDP hijacking (B) is incorrect because UDP is connectionless and does not use acknowledgment numbers or reset packets in this manner. TCP/IP hijacking (D) is a broad category, but RST hijacking is the specific mechanism described. Blind hijacking (A) refers to hijacking without seeing the traffic, which often involves guessing sequence numbers, but the defining feature here is the injection of the RST packet itself.Community Comment Notes
Community consensus strongly supports option C, with users citing the CEH v12 textbook module on Session Hijacking. Comments emphasize that the act of injecting a reset packet is the primary identifier for RST hijacking, clarifying that the 'guessing' aspect relates to the blind nature of the attack rather than changing the technique name.Exam Strategy
When analyzing session hijacking questions, focus on the specific packet type injected (e.g., SYN, ACK, RST) and the resulting action (connection established vs. terminated). If the goal is to kill the session, look for RST hijacking.
Frequently Asked Questions
Why isn't this considered Blind Hijacking?
While blind hijacking involves guessing sequence numbers, the specific technique of injecting a reset packet to kill the session is classified as RST hijacking.
Can RST hijacking work if the ACK number is wrong?
No, the reset packet must contain a valid acknowledgment number within the window to be accepted by the victim's TCP stack.