Session Donation vs. Session Fixation Attack

312-50v13 By islever Editorial Last updated

Session Hijacking

Short answer

C The attacker uses a session donation attack by forcing the victim to submit sensitive data into the attacker's pre-existing session.

Question

Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney’s account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney’s account. What is the attack performed by Boney in the above scenario?
  1. Forbidden attack
  2. CRIME attack
  3. Session donation attack Correct Answer
  4. Session fixation attack

Key Takeaways

The key distinction is that in session fixation, the attacker hijacks the victim's session; here, the victim contributes to the attacker's session (donation).

This scenario describes a session donation attack where the attacker forces the victim to submit data into the attacker's existing session, rather than hijacking the victim's session.

Common mistake: Many learners confuse this with Session Fixation (D) because a fixed session ID is used, but they miss that the account belongs to the attacker, not the victim.

Expert Analysis

Why the Answer Is Correct

The correct answer is C — Session donation attack. In this specific scenario, Boney obtains his own valid session ID and forces the target employee to use it. When the employee enters sensitive payment details, those details are linked to Boney's account, effectively 'donating' the sensitive information to him. This is distinct from hijacking because the victim does not lose their own session; instead, they feed data into the attacker's session.

Why the Other Options Are Wrong

A Forbidden attack (A) generally refers to unauthorized access attempts without specific session mechanics. The CRIME attack (B) exploits TLS compression to extract secrets via timing side-channels, unrelated to session IDs. Session fixation (D) involves an attacker setting a session ID on the victim's browser so that when the victim authenticates, the attacker can hijack that session. Here, the victim is not authenticating into their own account; they are acting within the attacker's pre-existing context.

Community Comment Notes

While the majority voted for D, arguing that the session ID was fixed, commenters like cb56e21 correctly identified the core mechanic: "it’s the attacker’s account that is used, and the victim just funnels sensitive information into it." Others noted that session fixation requires the attacker to take over the victim's authenticated session, which is not what happens here as the victim never logs into their own account under the attacker's control.

Exam Strategy

Always identify whose account or session the sensitive data ends up in. If it ends up in the attacker's session, it is likely session donation. If the attacker takes over the victim's session after the victim authenticates, it is session fixation.

Frequently Asked Questions

How do I distinguish Session Donation from Session Fixation?

Session Fixation involves the attacker taking over the victim's session after the victim authenticates. Session Donation involves the victim submitting data into the attacker's already-established session.

Why isn't this a Session Hijacking attack?

Session hijacking typically implies stealing an active session token. Here, the attacker created the session beforehand and tricked the victim into contributing to it, fitting the 'donation' model.

More 312-50v13 FAQ →

Community Votes

D
73%
C
27%

73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. agastya_5272 👍 2 Answered D
    The correct answer is: D. Session fixation attack A session fixation attack is a type of attack where an attacker fixes a session ID on a user's device, allowing the attacker to hijack the user's session. In this scenario: 1. Boney obtains a valid session ID by logging into a service. 2. He feeds the same session ID to the target employee using an MITM (Man-in-the-Middle) attack technique. 3. When the target employee clicks on the link, they are linked to Boney's account page without disclosing any information to the victim. 4. The sensitive payment details entered by the target employee are linked to Boney's account. OPTION C: Its not an any cyber attack .
  2. SukhoiF35 👍 2 Answered D
    Web session security prevents an attacker from intercepting, brute forcing, or predicting the session ID issued by a web server to a user’s browser as proof of an authenticated session. However, this approach ignores the possibility of the attacker issuing a session ID to the user’s browser, forcing it to use the chosen session ID. This type of attack is called a session fixation attack because an attacker fixes the user's session ID in advance, instead of generating it randomly at the time of login.
  3. killwitch 👍 2 Answered D
    D. Session fixation attack. Session fixation attack is a technique where an attacker forces a pre-determined session ID onto a victim. The goal is to trick the victim into using the attacker's session ID, allowing the attacker to hijack the session once the victim authenticates.
  4. cb56e21 👍 2 Answered C
    In this question’s scenario, it’s the attacker’s account that is used, and the victim just funnels sensitive information into it. That’s the hallmark of a session donation attack.
  5. Booict 👍 1 Answered D
    D - In a session fixation attack, the attacker sets a user's session ID to a known value, then tricks the user into authenticating with that session ID. This allows the attacker to hijack the user's session and access sensitive information
Show 2 more comments
  1. nicejob 👍 1 Answered D
    session fixation, first attack get session id from victim, then wait victim logged attaack can get information Session ID is same
  2. MHafizC 👍 1 Answered C
    The answer should be session donation attack.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide