COOKIES STEALING: HACK FACEBOOK SESSIONS

Today we’ll be hacking Facebook profiles active on your local network.
You may think, “How is this useful, nobody but me is using my network.” Well, you can use this on other Wi-Fi networks that are available for free (like at Starbucks) and crack their precious Facebook profile!
 

a1

How?

We are going to use a well known method called “The cookie injection method.” This might be far off from becoming “elite”, but you need to get familiar with your Linux distribution first.

Step 1: Get the Right “Stuff”

For this hack, you’ll need a few things. Nothing special, but you’ll need these stuff.

My best suggestion is that you first install BackTrack, Kali Linux, or Bugtraq because they have almost everything we need.

For this little magic trick, we’ll need:

  • A working Linux distribution (preferably Kali, Backtrack or Bugtraq)
  • Wireshark (a packet sniffer)
  • Firefox (web browser)
  • Nmap (scanner)
  • Greasemonkey (addon for Firefox)
  • Cookie injector (script for Greasemonkey)*

Now let’s start doing some magic! :D*

Step 2: Network Scan

First, to actually connect to a target, we’ll need an IP address. In order to get that, you’ll need to do a network scan with Nmap. So go ahead and boot up your terminal and enter the following command:

  • nmap -F 192.168.xx.xx/24

Note: If this doesn’t work, use 10.0.x.x/24 instead.

This command will scan your network for any IP addresses connected to it. The -F gives the console the instruction to use “Fast mode.” If done correctly, you should see something like this:

 

a2

That’s how your Nmap scan should look like.

Step 3: Starting the “Man-in-the-Middle Attack”

Now we’re going to start a man-in-the-middle attack, MITM for short.

In MITM attack, we spoof our MAC address so that when a server responds, person sends a message to the other, he won’t be receiving that message, but he will receive messages that we send, as we’re the Man in the middle.

This might help you understand:

a3

A man-in-the-middle attack!

Starting the Attack

To start, enter the following command in a NEW terminal window:

  • sudo echo 1 >> /proc/sys/net/ipv4/ip_forward

This will forward your IP address. Now we’re starting the MITM by opening a NEW terminal window and entering this command:

  • sudo arpspoof -i [Interface] -t [target] [default gateway]

If you don’t know your interface and default gateway, start a new terminal and enter: ipconfig.

a4

This is the result form the arpspoof.

Open (once again -_-) a new terminal window and enter the following command:

  • sudo arpspoof -i [interface] -t [default gateway] [target]

a5

Another result from the arpspoof!

Note: After you entered both the arpspoof commands DON’T CLOSE THE TERMINALS.

Step 4: Firefox and Wireshark (Almost Done!)

We need a few more things in order to complete this hack!

First install Firefox, then Greasemonkey and the cookie injector script. Then, install Wireshark, which you can do by entering this command into a terminal window:

  • sudo apt-get install wireshark

After that, open up a Wireshark session (open a terminal and enter sudo Wireshark as command). Select your interface and start capturing. At the top, you should see an input box where you can add filters. Now enter this filter:

  • http.cookie contains DATR

Now you should get a list in Wireshark. Search for a cookie that contains the text GET. Locate it, click on it with the left mouse button, select copy, select bytes, select printable text only.

a6

Wireshark result. The one you need is in the black circle.

Now go to Wireshark and go to Facebook. Make sure you’re NOT logged in. If you are, go to settings and delete all the cookies. Then go back to the Facebook log-in page, press [ALT]+C, and paste the cookie. Press OK and refresh the page.

a7

Here you can clearly see the cookie injector script input box.

If my magic worked, you should see the main Facebook timeline. If not, then you’ve done something wrong.

My Final Comments

This hack may seem advanced, but it’s actually really easy. Once you break down all the steps, it’s a piece of cake! 😀

Now that you’ve done this, it should be clear that Facebook security isn’t very strong 😛

Quick note: This only works if your target is actually browsing through Facebook over http (not https) at the time you’re doing the hack.

Note: All contents are provided for educational purposes only. 

External Links:

Greasemonkey: https://addons.mozilla.org/en-US/firefox/addon/748
HTTP Protocol: http://en.wikipedia.org/wiki/HTTP
TCP Protocol: http://en.wikipedia.org/wiki/TCP
Cookies: http://en.wikipedia.org/wiki/HTTP_cookie
Wireshark: http://www.wireshark.org/
Ettercap: http://ettercap.sourceforge.net/
ARP Poisoning: http://en.wikipedia.org/wiki/ARP_spoofing

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s