Sybex CEH Certified Ethical Hacker Version 8 Study Guide

296 Chapter 12 ■ Session Hijacking
you’ll face. We’ve already covered a few of these, so we’re ahead of the game! Just pay
attention to the sequence and relate it to what you’ve already learned.
1. Referring back to Chapter 9 once more, you must have a means of sniffing or capturing
the traffic between the victim machines. This places you in the position required to
perform the hijack.
2. Predict the sequence numbers of the packets traversing the network. Remember that
null packets can be used to increment the host sequence numbers, thereby desynchronizing
the victim’s connection and making sequence number prediction easier.
3. Perform a denial-of-service attack on the victim’s machine, or reset their connection
in some fashion so you can assume the victim’s role as the legitimate client. Remember
that in a passive hijacking, the victim connection is not necessarily severed; the traffic
between the victim and the host is simply monitored, and you wait for the opportune
time to act.
4. Once you take over the victim’s session, you can start injecting packets into the server,
imitating the authenticated client.
Be sure that you understand TCP hijacking and the packet sequencing an
attacker uses to implement the attack. Refer to Chapter 9 if necessary to
help you get comfortable with these topics. Both will show up on the exam
and will be applied to session hijacking.
Let’s go back to blind hijacking for a moment. As we discussed earlier, in blind hijacking
the attacker is not able to see the result of the injected packets, nor are they able to
sniff the packets successfully. This creates a major challenge for the attacker because
sequencing packets properly is a critical step in launching a successful TCP-based session
hijacking. Referring back to Chapter 9, recall that there is a logistical challenge in sniffing
traffic from other networks or collision domains. This is because each switchport is an
isolated collision domain. An attacker attempting to perform a session hijack attack on
a victim machine outside the attacker’s network or network segment creates a challenge
similar to the one you faced in sniffing traffic in Chapter 9. The attacker will be going in
“blind” because they will not be able to receive a return traffic confirmation of success.
Hacker on the Run
The infamous hacking saga of Kevin Mitnick is always a good read for ethical hackers as
well as Tom Clancy fans. Mr. Mitnick’s hacking activities finally landed him in prison in
1995, but the events leading up to the arrest read like a suspense novel. The noteworthy
portion of the story is the fact that Mitnick used IP spoofing and a form of TCP session
hijacking to gain access to the resources that inevitably landed him in hot water. This is