When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a “cookie” which is used by your browser for all subsequent requests.
It is extremely common for websites to protect your password by encrypting the initial login, but very uncommon for websites to encrypt everything else. This leaves the user cookie vulnerable. HTTP session hijacking (sometimes called “sidejacking“) is when an attacker gets a hold of a user’s cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.
This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new “privacy” features in an endless attempt to quell the screams of unhappy users, but what’s the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room. This is where Firesheep comes into picture. It acts as a single click session hijacking tool.
How to use Firesheep?
After installing the extension you will see a new sidebar. Connect to any busy open WiFi network and click the big “Start Capturing” button.
The only dependency is we need to find an open WiFi network and connect to it. This could be easy to find in today’s environment. We also need WinPcap for capturing.
Open the page with Firefox and install the plugin. Click here for Firesheep.
Searches leading to this post:
how to use firesheep, use firesheep, firesheep how to use, session hijacking tools, firesheep update, how to use fire sheep, firesheep usage, how use firesheep, firesheep use, how do i use firesheep, session hijacking firefox, session hijacking tool, how to work firesheep, firesheep mirror, how do you use firesheep, session hijack firefox, firesheep download mirror, firesheep download, how to usefiresheep
Comments on this entry are closed.