Scribd
Upload
736 views

11.3 Session Hijacking Tools

The document discusses session hijacking tools including Burp Suite, Firesheep, CookieCatcher, Cain and Abel, and DroidSheep. Firesheep is a Firefox extension that intercepts unencrypted session cookies for websites. CookieCatcher is an open source tool that uses XSS vulnerabilities to steal user session IDs. DroidSheep is an Android tool that captures session IDs by listening to wireless conversations.

Uploaded by

Christopher Agbagba
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
736 views

11.3 Session Hijacking Tools

The document discusses session hijacking tools including Burp Suite, Firesheep, CookieCatcher, Cain and Abel, and DroidSheep. Firesheep is a Firefox extension that intercepts unencrypted session cookies for websites. CookieCatcher is an open source tool that uses XSS vulnerabilities to steal user session IDs. DroidSheep is an Android tool that captures session IDs by listening to wireless conversations.

Uploaded by

Christopher Agbagba
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 20

CBTU presents Ethical Hacker training course based on

by

Module 11: Session hijacking


Section 11.3 : Session hijacking tools

Note: All the logos, trademarks are copyrights of the respective companies. CEH is the trademark of EC-Council (www.eccouncil.org).
Caution: Ethical Hacker course is for educational purpose only and NOT to be used for unethical, illegal and malicious
activities. All over the world Cyber Laws enforce strict punishments for violation of ethics, gaining unauthorized access to
any computer system/network and related illegal activities.
Session hijacking tools
• Burp Suite • Firesheep
• OWASP ZAProxy • CookieCatcher
• Cain and Abel • TamperIE
• Hamster and Ferret • PerJack
• JHijack • Surf Jack
• Ettercap • Juggernaut
• Dsniff • Cookie Cadger
• Telerik Fiddler • Charles Proxy
Firesheep
Firesheep is Firefox extension that uses a packet
sniffer to intercept unencrypted session cookies
from websites
– The plugin eavesdrops on Wi-Fi communications,
listening for session cookies. Detects a session cookie
and capture session id
– The collected identities are displayed in a side bar in
Firefox and by clicking on a victim's name, the victim's
session is taken over by the attacker.
CookieCatcher
CookieCatcher is an open source application
exploits XSS (Cross Site Scripting) vulnerabilities
within web applications to steal user session IDs
(aka Session Hijacking).
https://github.com/DisK0nn3cT/CookieCatcher
CookieCatcher - features
• Prebuilt payloads to steal cookie data
• Just copy and paste payload into a XSS vulnerability
• Send email notification when new cookies are stolen
• Refresh cookies every 3 minutes to avoid inactivity timeouts
• Provides full HTTP requests to hijack sessions through a proxy
• Attempt to load a preview when viewing the cookie data
• PAYLOADS
– HTTPONLY evasion for Apache CVE-20120053, Basic AJAX Attack etc.
Other Tools
DroidSheep is an android tool for web session
hijacking (sidejacking) captures session id by
listening to the wireless conversations.
– The apk was made available on Google Play but it
has been taken down by Google.
Thanks for watching
Visit us at: CBTUniversity.com
Write to us at: [email protected]
Reach us at:  +91 963 246 5599

You might also like