Well
I have posted lots of articles on Phishing and keylogging, but today I
would like to throw some light on a very useful method which hackers use
to hack gmail, facebook and other email accounts i.e. cookie stealing and session hijacking.
What is a Cookie?Cookies are small files that websites put on your computer when your browser accesses a website that uses cookies. cookies are used to to keep track of your movements within the site, help you resume where you left off, remember your registered login, theme selection, preferences, and other customization functions.
Whenever we sign into an account it generates a unique piece of string. One copy is saved on server and other in our browser as cookie. Both are matched every time we do anything in our account.
Cookies allow you to proceed through many pages of a site quickly and easily without having to authenticate or reprocess each new area you visit.
Example of cookie:
What is a cookie stealing and Session Hijacking ?"A session hijacking attack is basically an act of stealing stored session cookies and injecting it into your own browser to gain access to victims account."
In this procedure, an attacker can steal session cookies by convincing slave to run a piece of code in browser (normally any java script ) or by any how ask slave to visit to any link that have session stealing php script . As soon as Victim do that, attacker gets his session cookies. Now Attacker can use this stolen session to login into slave's account without providing any username/password. This attack is very uncommon because when the slave clicks 'Sign out', session gets destroyed and attacker too also gets signed out.
But in case of some sites that use persistent cookies attacker doesn’t get signed out when slave clicks 'Sign out'. In destroy session automatically after any particular time. for Ex. Yahoo, it destroy cookies after 24hrs But if user simply refreshes the windows in yahoo account with in 24 hrs, then he gets sessions again for next 24 hrs. This means, once the yahoo account session is stolen, attacker can access the account for life time by refreshing window in every 24hrs.
How the stealing process work?
1. The attacker creates a PHP script and uploades it to any webhosting site.
2. The attacker then asks the slave to visit that particular link containing the PHP code.
3. Once the slave visits it his/her authentication cookie is saved in a .txt file.
4. Next the attacker uses a cookieinjector or a cookie editor, and replaces his own cookies with the victims cookies as a result of which the victims session is hijacking, and he got access to victim's account.
Well, this all was the theory About Cookie Stealing and how it works, in my next post i will explain how you can done all this practically....
What is a Cookie?Cookies are small files that websites put on your computer when your browser accesses a website that uses cookies. cookies are used to to keep track of your movements within the site, help you resume where you left off, remember your registered login, theme selection, preferences, and other customization functions.
Whenever we sign into an account it generates a unique piece of string. One copy is saved on server and other in our browser as cookie. Both are matched every time we do anything in our account.
Cookies allow you to proceed through many pages of a site quickly and easily without having to authenticate or reprocess each new area you visit.
Example of cookie:
- Have you ever put something in a virtual shopping cart in an online store and then returned a few days later to find that the item is still there? That's an example of cookies at work.
- When you login on gmail or facebook, you need to give ur username and password only once, but after that each time when u navigate from one page to another, it redirect you without asking for those information(username and password) asked before.
- session cookies: Session cookies are created temporarily in your browser's subfolder while you are visiting a website. Once you leave/sign out from the site, the session cookie gets deleted.
- Persistent Cookies: Persistent cookie files remain in your browser's subfolder and are activated again once you visit the website that created that particular cookie. A persistent cookie remains in the browser's subfolder for the duration period set within the cookie's file.
What is a cookie stealing and Session Hijacking ?"A session hijacking attack is basically an act of stealing stored session cookies and injecting it into your own browser to gain access to victims account."
In this procedure, an attacker can steal session cookies by convincing slave to run a piece of code in browser (normally any java script ) or by any how ask slave to visit to any link that have session stealing php script . As soon as Victim do that, attacker gets his session cookies. Now Attacker can use this stolen session to login into slave's account without providing any username/password. This attack is very uncommon because when the slave clicks 'Sign out', session gets destroyed and attacker too also gets signed out.
But in case of some sites that use persistent cookies attacker doesn’t get signed out when slave clicks 'Sign out'. In destroy session automatically after any particular time. for Ex. Yahoo, it destroy cookies after 24hrs But if user simply refreshes the windows in yahoo account with in 24 hrs, then he gets sessions again for next 24 hrs. This means, once the yahoo account session is stolen, attacker can access the account for life time by refreshing window in every 24hrs.
How the stealing process work?
1. The attacker creates a PHP script and uploades it to any webhosting site.
2. The attacker then asks the slave to visit that particular link containing the PHP code.
3. Once the slave visits it his/her authentication cookie is saved in a .txt file.
4. Next the attacker uses a cookieinjector or a cookie editor, and replaces his own cookies with the victims cookies as a result of which the victims session is hijacking, and he got access to victim's account.
Well, this all was the theory About Cookie Stealing and how it works, in my next post i will explain how you can done all this practically....
Labels:
Hacking
,
Knowledge
Previous Article
Responses
0 Respones to "How cookie Stealing Hack Works : Basic about Session Hijacking"
Post a Comment