During a penetration test at Pinnacle Bank in Chicago, ethical hacker Sarah injects crafted TCP...

The correct answer is B. Blind Hijacking because the scenario describes injecting crafted TCP packets into an active client–server session to disrupt the legitimate client and take over the connection, without requiring the attacker to see (or fully rely on seeing) the server’s responses. In CEH-aligned session hijacking classifications, blind hijacking is an active takeover technique at the TCP/session layer where the attacker forges packets (often with predicted or inferred TCP sequence numbers) to insert data into an existing session and potentially desynchronize the legitimate endpoints. By injecting traffic that causes instability (for example, triggering retransmissions, resets, or sequence/ack mismatch), the attacker can effectively push the victim out of sync or off the session while continuing to communicate with the server as if they were the client.

The key clue is that Sarah “injects crafted TCP packets” into an “active communication,” and then the “victim’s connection becomes unstable,” after which Sarah’s system “maintain[s] communication with the server in place of the legitimate client.” This aligns with blind hijacking concepts where the attacker does not simply observe (passive) but actively manipulates the TCP stream to seize control. The attacker’s goal is forced takeover of a live session, which often involves sequence prediction and packet injection to become the effective participant while the real client experiences disruption.

Why the other options are incorrect: Passive session hijacking is eavesdropping/monitoring traffic to capture session identifiers without altering the session; it does not involve injecting packets or destabilizing a connection. Man-in-the-Browser is a client-side attack (typically via malware in the browser) that manipulates transactions within the browser context; it is not a TCP packet injection technique. Active session hijacking is a broad category and is true at a high level, but the question asks for the type—and the specific technique described (TCP injection causing takeover) maps most directly to blind hijacking in CEH-style terminology.

Therefore, Sarah is demonstrating blind session hijacking.