Certified Ethical Hacker (CEH) Practice Question

The described attack assumes the server will accept a session identifier that the attacker has set in advance. By forcing the victim to authenticate using this pre-defined ID-embedded in the URL-the attacker can later reuse the same token to take over the victim's session. This is the essence of session fixation. Cross-site request forgery abuses an existing authenticated session to trigger unwanted actions, not to steal the session ID itself. Session prediction involves guessing valid, server-generated tokens rather than fixing one. Clickjacking relies on UI redressing, not on manipulating session identifiers.