Who needs to hack passwords when when you can steal & hijack cookie sessions (use sslstrip if you must *not included*)