FirstTry

Exam objective

CEH

Session Hijacking

This objective sits in Network and Perimeter Hacking, which carries 24% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Network and Perimeter Hacking

A developer must size a session identifier so that guessing a live one stays impractical. Which floor does the guidance set?

At least 16 characters of any encodingSixteen hexadecimal characters happen to carry the required randomness, but the same count in another encoding does not.
At least 64 bits of entropy from a CSPRNGCorrect · your answerCorrect.
At least one bit per authenticated userSessions are not sized per user, and an identifier space that small would collide immediately.
At least 32 bits of entropy plus a counterHalf the required randomness leaves a space an attacker can search, and a predictable counter adds nothing.

Correct.

Checked against cheatsheetseries.owasp.org, September 2026

Concept

Resistance to guessing is a property of unpredictability, not of how long a string looks. A value drawn from a cryptographic generator with enough randomness makes a search through the space impractical at any realistic rate.

Why B

The floor is stated in randomness rather than characters, and the generator matters as much as the width, since patterns in the output reduce the real search space.

Source

Session identifiers must have at least 64 bits of entropy to prevent brute-force session guessing attacks.... A strong CSPRNG (Cryptographically Secure Pseudorandom Number Generator) must be used to generate session IDs.

OWASP Cheat Sheet Series, Session Management Cheat Sheet, checked September 2026
#session-id-entropy#csprng#session-management

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Network and Perimeter Hacking

An application carries its session identifier in the query string of every page. Which exposure does that create?

Sample question 2 of 3

Network and Perimeter Hacking

A tester finds an application that will accept a session identifier from a URL parameter as well as from its cookie. Which change follows?

Sample question 3 of 3

Network and Perimeter Hacking

An application serves only HTTPS, yet a tester still forces a browser to send its session cookie over plain HTTP. Which cookie attribute was missing?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network and Perimeter Hacking