Sidejacking | Firesheep Tutorial and Countermeasures.

Recently Eric butler at Toorcon12 exposed and demonstrated the session hijacking problem (aka sidejacking) with the help of a selfmade addon of firefox called "Firesheep".Using this method the attacker can control the account of the victim even knowing the password .This tool can also be used to hack facebook account
,twitter etc.Today in this post I will discuss how this is carried out and the countermeasures needed to avoid this problem.So lets start....

I recommend readers if they abide by the blog's Disclaimer then they can proceed reading this post otherwise leave this page immediately.

What is Http Session hijacking(aka Sidejacking)?

In session hijacking an attacker hijacks(or controls) the user's session after the user has successfully logined or authenticated with the desired server.Here in this post the addon "firesheep" works like a sniffer and captures the cookies of the user on the same wireless network used to authenticate to few predefined webpages in the addon.This problem still persits in https websites also because it only encrypt the login of the users but after the rest of the session is left unencrypted.


Requirements:

1.Public Wifi access.

2.Winpcap (Download)

3.Firesheep (Download)

Procedure:

1.Download the "firesheep" from the above link and using the "openwith" option open it in Firefox.

2.Having installed it,restart the browser and follow the instruction in the image below.

3.Now you can see the firesheep has opened up in the sidebar then follow the instructions in the image below.

4.Then click on the "Start capturing" button at the top.Before doing this make sure that you are connect to an open wifi network say your college or campus wifi.

5.After doing that wait for few seconds and you will see the result will start appearing in the sidebar as shown below.Click on any result and the pre authenticated session will open in your browser.

So the users using public wifi like in airport or accessing internet in coffee shop need to be careful.Follow the below countermeasures

Countermeasures:

1.Https is not the solution to this problem rather you can use VPN to access public wifi.There are few paid services also look out in google.

2.You can also setup your own server using Cygwin and use the SSH client putty to use it and configure your browser to use socks proxy.Then access the desired website.