Session Donation vs. Session Fixation Attack
Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney’s account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney’s account. What is the attack performed by Boney in the above scenario?
Community Votes
73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key distinction is that in session fixation, the attacker hijacks the victim's session; here, the victim contributes to the attacker's session (donation).
This scenario describes a session donation attack where the attacker forces the victim to submit data into the attacker's existing session, rather than hijacking the victim's session.
Many learners confuse this with Session Fixation (D) because a fixed session ID is used, but they miss that the account belongs to the attacker, not the victim.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is C — Session donation attack. In this specific scenario, Boney obtains his own valid session ID and forces the target employee to use it. When the employee enters sensitive payment details, those details are linked to Boney's account, effectively 'donating' the sensitive information to him. This is distinct from hijacking because the victim does not lose their own session; instead, they feed data into the attacker's session.Why the Other Options Are Wrong
A Forbidden attack (A) generally refers to unauthorized access attempts without specific session mechanics. The CRIME attack (B) exploits TLS compression to extract secrets via timing side-channels, unrelated to session IDs. Session fixation (D) involves an attacker setting a session ID on the victim's browser so that when the victim authenticates, the attacker can hijack that session. Here, the victim is not authenticating into their own account; they are acting within the attacker's pre-existing context.Community Comment Notes
While the majority voted for D, arguing that the session ID was fixed, commenters like cb56e21 correctly identified the core mechanic: "it’s the attacker’s account that is used, and the victim just funnels sensitive information into it." Others noted that session fixation requires the attacker to take over the victim's authenticated session, which is not what happens here as the victim never logs into their own account under the attacker's control.Exam Strategy
Always identify whose account or session the sensitive data ends up in. If it ends up in the attacker's session, it is likely session donation. If the attacker takes over the victim's session after the victim authenticates, it is session fixation.
Frequently Asked Questions
How do I distinguish Session Donation from Session Fixation?
Session Fixation involves the attacker taking over the victim's session after the victim authenticates. Session Donation involves the victim submitting data into the attacker's already-established session.
Why isn't this a Session Hijacking attack?
Session hijacking typically implies stealing an active session token. Here, the attacker created the session beforehand and tricked the victim into contributing to it, fitting the 'donation' model.