A hacker wants to record a live session between a user and a host in hopes that parts of the datastream can be used to spoof the session. Which of the following attacks is this person attempting?

A session replay attack involves an attacker intercepting and recording a valid user's data session with a host or server. The attacker then re-transmits, or "replays," this captured data (which can include session tokens or cookies) to the server. The server, unable to distinguish the replayed session from the original legitimate one, grants the attacker the same access and privileges as the original user. The question's description of recording a live session to spoof it perfectly aligns with the mechanics of a session replay attack.

A. Fuzzing: This is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a program to find security vulnerabilities.
C. Bit flipping: This is a cryptographic attack that involves subtly modifying ciphertext to cause a predictable change in the corresponding plaintext after decryption, not replaying a session.
D. Reverse shell: This is a technique where a compromised machine initiates a connection back to an attacker's machine, providing the attacker with shell access, not impersonating a user session.

1. OWASP Foundation. (n.d.). Session replay attack. OWASP Community Pages. Retrieved from https://owasp.org/www-community/attacks/Sessionreplayattack.

Reference Point: The "Description" section states

"A session replay attack occurs when an attacker steals a valid session ID... and reuses it to impersonate an authorized user." This directly supports the correct answer.

2. OWASP Foundation. (n.d.). Fuzzing. OWASP Community Pages. Retrieved from https://owasp.org/www-community/Fuzzing.

Reference Point: The "Summary" section defines fuzzing as a technique that "consists in finding implementation bugs using malformed/semi-malformed data injection

" which distinguishes it from session replay.

3. Purdue University. (2021). CS 42600: Computer Security

Lecture 13 - Web Security.

Reference Point: In slides discussing web attacks

Session Replay is described as a form of impersonation where an attacker captures and reuses a user's session cookie. This academic source validates the core concept.

4. National Institute of Standards and Technology (NIST). (2021). NIST Special Publication 800-63B: Digital Identity Guidelines.

Reference Point: Section 5.1.1 discusses "Replay Resistance" for authenticators

noting that protocols must be "resistant to replay attacks" where an "eavesdropper can record the authentication protocol messages and simply replay them at a later time." This officially defines the threat described in the question.