Dylan found a vulnerability on a web application that let him copy the sessionID out of a local cookie and place it into another cookie, therefore assuming the identity of the original user. The problem is that the server also associates the originating IP address. Dylan simply spoofs that address but he then finds he cannot establish an interactive session with the server. Why?
A) The attack should work as stated.
B) There is a NAT firewall preventing this activity
C) Dylan cannot spoof his address over HTTP
D) The server will send all replies back to the spoofed IP.

Question

Quizplus · Accepted Answer

The sessionID and other HTTP commans are passed between client ans server at Layer 7, but they are encaspulated by a layer 4 transport that must establish a socket. The socket alos involves layer 3, spoofing an IP address prevents traffic from returning and the socket is never set.

Dylan Found a Vulnerability on a Web Application That Let