GIAC Certified Incident Handler (GCIH) — Question 141

An attacker has tricked a user into executing content he placed on a social networking site. The malicious content executes in the victim's browser and allows the attacker to determine if machines behind the user's firewall are up and running. What type of attack is this?

Answer options

• A. Cross Site Scripting
• B. SQL Injection
• C. Account Harvesting
• D. Session Hijacking

Correct answer: D

Explanation

The correct answer is D, Session Hijacking, because the attack allows the attacker to gain unauthorized access and manipulate sessions. Option A, Cross Site Scripting, typically involves injecting malicious scripts but does not directly relate to checking the status of machines behind a firewall. Options B and C, SQL Injection and Account Harvesting respectively, do not apply to the scenario described.