Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack…

The scenario describes a session donation attack, which is a specific variant of a session fixation attack. In this attack, the adversary (Boney) first logs into a web application to obtain a valid, authenticated session ID. He then "donates" this session to the victim by tricking them into using it, for instance, by sending them a crafted link. When the victim performs actions, such as submitting payment details, they do so within the attacker's authenticated session. Consequently, the sensitive information is linked to the attacker's account, achieving the attacker's goal.

B. Session fixation attack: This is a broader category. Session donation is a more precise description of the attack where an already authenticated session is given to the victim.

C. Forbidden attack: This is a cryptographic attack that exploits nonce reuse in TLS with GCM mode, which is unrelated to the session management logic described.

D. CRIME attack: This is a side-channel attack that exploits compression in protocols like TLS/SSL to steal secret cookies, not donate a session.

1. OWASP Foundation. (n.d.). Session fixation. OWASP. Retrieved from https://owasp.org/www-community/attacks/Sessionfixation. (The "Attack Scenarios" section describes the general mechanism where an attacker provides a session identifier to a user

which aligns with the donation variant when the session is pre-authenticated by the attacker).

2. Mitropoulos

S.

& Spinellis

D. (2010). An analysis of session vulnerabilities in web applications. Computers & Security

29(8)

847-857. https://doi.org/10.1016/j.cose.2010.01.005 (Section 3.1

"Session Fixation

" discusses the core vulnerability where an attacker can fixate a user's session identifier

with donation being a specific implementation of this principle).

3. Boneh

D.

& Shoup

V. (2020). A Graduate Course in Applied Cryptography. Stanford University. Version 0.5

Chapter 15

"Web Security

" pp. 535-537. (This chapter discusses session management and hijacking

explaining the fundamental concept of an attacker controlling the session token used by the victim

which is the basis for both fixation and donation attacks).