Tuesday, February 1, 2011

FIRESHEEP TUTORIAL (Http Session Hijacking)

Firesheep a Firefox addon has recently become very popular for easily carrying out a HTTP session hijacking attack. Http session hijacking attack can't be considered as a very sophisticated attack but needs some technical knowlegde to be performed . But Firesheep makes the attack a child's play. Firesheep was developed by Eric butler for Firefox, it was released at Toorcon 12 to demonstrate how serious cookie stealing can be.
Now lets understand how Firesheep actually works. When you provide your username and password in login forms of different website and submit it, the browser first encrypts the password and then sends it over the network. The corresponding website compares the information against its internal database and if they match, it sends a cookie(a small text file) to your browser. The browser saves this cookie and uses it to authenticate the user on the website every time the user opens a different page of the website. When the user logs out of his account the browser just deletes the cookie. Now the problem is that this cookies are not encrypted before sending over the network, due to this a hacker can capture this cookies and using them authenticate himself as the user from whom the cookie was stolen.
Now lets see how to use Firesheep.


Step 1) First download and install WinPcap (WinPcap in Windows is used for capturing network traffic.)
            You can use Pcap in libPcap library for unix like systems.
            DOWNLOAD WinPcap

Step 2) Download and open Firesheep in Firefox, it will automatically install it. Or just drag it and place it
             over Firefox shortcut (Firesheep at this instant is not supporting Firefox 4 ).
             DOWNLOAD Firesheep.

Step 3) After it is installed, in Firefox go to View -->Sidebar --> Firesheep. A side bar will appear in the
            browser with a button "start capturing", press it and sit back. In few seconds you will see account
            details with photos of the target. Click on one of it and you will directly enter in his account. Simple
            as that.

Note:- Using Firesheep to hijack others account is illegal under wiretapping Act.

29 Responses to “FIRESHEEP TUTORIAL (Http Session Hijacking)”

vettukal said...

Great work!!! Keep doing it!!
All the best

Anonymous said...

is this easily tracked?

Teja said...

FIRESHEEP TUTORIAL is not working for latest versions of firfox

Teja said...

i am using firefox 3.0
no sidebar found
but successfully installed FIRESHEEP TUTORIAL

mayur shett said...

@Teja
Eric butler created Firesheep for a security conference where he wanted to bring to the attention, how easy it can be to get other's passwords at Wi-Fi hotspots. That done i think he has no reason to maintain Firesheep as he is a cyber security expert and may not want to encourage it.

To get the sidebar after it is installed, in Firefox go to View -->Sidebar --> Firesheep.

Anonymous said...

firesheep still can be use ?

Anonymous said...

If it is done will anyone track it out?

Anonymous said...

i dwnloaded firesheep but how can i install it?if i try to open the file they say to search for a prgram to find out from the web

mayur shett said...

@Anonymous
Ya so when the box pops out asking to open the file go to select other programs and choose firefox. It will automatically install it for you.

Anonymous said...

when i click on start capturing it shows an error "invalid interface" what can i do........... help me

Anonymous said...

I press "start capturing" but it does nothnig.

Anonymous said...

so,firesheep captures random people's information. what if i want to know only one specific person's password (also consider that i do not have a physical access to his computer)- and i do not want to use Phishing, advise please?
-C.c.

Anonymous said...

This doesnt work for me I cant even get it to "start capturing"

Anonymous said...

this sucks and its dumb i hate this ,skrew this thing

Anonymous said...

Do i need to have a wireless connection or can i do it with a dial-up connection?

ahmad said...

i have confused
i dnt know how to use any of them

Anonymous said...

in my firefox error is coming indicating Invalid Interface

Anonymous said...

i was trying to instal FIRESHEEP TUTORIAL .....bt its nt hapng...tell me guyz any sugetion i alrdy instal winpcap bt nthng is wrking....???

iStudio said...

i can't install firesheep for firefox 9.0.1

Kristo Lito said...

0/connect to a network
1/download firefox 3.6.17
2/download the firesheep xpi file
3/open the firesheep file with firefox
4/install it
5/restart firefox
6/view-sidebar-firesheep
7/good luck !

qoley said...

hey, i have already installed firesheep xpi file to the fireox 3.6.17, after that i restart the firefox and i not see the view sidebar firesheep at the firefox 3.6.17... why?

Anonymous said...

duuuuddeee please tell me how to hack a single persons account using this ??

Anonymous said...

not capturing any data or account... i have clicked start capturing

Anonymous said...

when I click start capturing it says invalid interface?

Minsha mughal said...

helooo i am dowonload fire sheep all is okk but dosenot capture any thing plzzzzzz help me reply of me my email minsha107@gmail.com

Unknown said...

It makes sense that you need to input the target network/session in order to capture data. You have to aim.

Leave a reply

 
© 2009 BASIC HACK AND TECH FOR BEGINNERS. All Rights Reserved | Powered by Blogger
Design by psdvibe | Bloggerized By LawnyDesigns