The type of attack depicted in the figure is a session fixation attack. Here’s a step-by-step explanation of how this attack works:

The attacker creates a new session on a website and obtains a valid session ID.

The attacker then tricks the user into using this session ID, often by sending a link that includes the session ID as a parameter.

When the user logs in using this session ID, the attacker, who now knows the session ID, can hijack the session.

This allows the attacker to impersonate the user and carry out actions on their behalf.

In the context of the image, the steps are as follows:

The attacker logs into a bank website using his credentials.

The webserver sets a session ID on the attacker’s machine.

The attacker logs into the server using the victim’s credentials with the same session ID.

The attacker sends an email containing a link with a set session ID to the user.

The user clicks on the link and is redirected to the bank website.

The user logs into the server using his credentials and the fixed session ID.

The attacker can then use the same session ID to gain unauthorized access.

References: For more information on session fixation attacks, you can refer to security resources such as OWASP (Open Web Application Security Project) and other cybersecurity publications that discuss common web vulnerabilities and their mitigation strategies.