Backtrack Series - 12: Session Hijacking for Secure Websites

In this tutorial we will hijack a live session so that we can have the same priviliges of the account without having any information about the username and password. We will start by redirecting the secure traffic to an insecure server using SSLStrip, next we use ferret to extract cookies from the traffic and then we will use hamster to inject the cookies in the browser

For more information, please check:

Category:

Science & Technology

Tags:

• Hacking
• Rogue AP
• hamster
• wifi
• Backtrack
• remote-exploit
• password
• sslstrip
• ferret
• sidejacking
• cookie

[illegalmexicain]

could you upload it again i mean roguev3.sh link is dead on remote forum :(

rapishare will do good

[fifothekid]

@illegalmexicain try this link:

w w w . m u l t i u p l o a d . c o m / J 1 9 D Q X C F E 7

Don't forget to remove the spaces

[rabih212]

this video let me access my networks computer??whats the profit please reply!!

[fifothekid]

@rabih212 you really didn't understand the goal of this video...

[fifothekid]

Thnx for your reply

1- I didn't try wifizoo before. But the aim of my tutorials is to provide more than one approach for the same problem, as some people told me that wifizoo didn't work for them

2- grep for what? Cookie hijacking is not about getting the username and password. It's rather about fooling the server into thinking that you are the one who logged to the server, without even providing any username and password.

[Skymore88]

subscribing now!!

[illegalmexicain]

@fifothekid thanks alot, i think you were my only hope to get this file i uploaded the file to multiupload and share with other people i did put a legal notice in it just in case ;)

[CaptWheeto]

Why ferret and hamster? I thought wifizoo was able to do both of this (I'm probably wrong :P)

Also I normally log everything I capture to a file and then grep what I want. I don't see any advantages to using cookies, care to explain please? Very good video!

[novarcher]

is the rouge ap step necessary? or is it just to show a way of getting on the same network as the victim?

also i noticed you have ettercap running, your just using that with sslstrip right?