Challenge/response authentication is designed to prevent replay attacks. In this mechanism:
The server sends a random “challenge” string.
The client uses its secret (like a password or private key) to generate a response.
The server verifies that the response matches what it expected for that challenge.
Since the challenge is random and changes each time, an attacker cannot simply capture and replay previous responses to gain unauthorized access.
From CEH v13 Courseware:
Module 11: Session Hijacking
Module 6: Authentication Protocols
CEH v13 Study Guide states:
“Challenge-response authentication prevents replay attacks by using dynamically generated nonces or challenge tokens that change with each session.”
Incorrect Options:
B: Scanning attacks are not related to authentication mechanisms.
C: Session hijacking involves active takeovers, not replaying login attempts.
D: Password cracking targets password hashes, not session tokens.
[Reference:CEH v13 Study Guide – Module 11: Authentication Mechanisms and Replay Attack MitigationRFC 2831 – Digest Access Authentication, ==================================================================, ]
Submit