How to Become an Elite Hacker, Part 2: Spoofing Cookies to Hack Facebook Sessions « Null Byte :: WonderHowTo

Welcome back, my fellow hackerians! Today we'll be hacking Facebook profiles on your local network. You may think, "How is this useful, nobody but me is using my network." Well, you can use this on other Wi-Fi networks that are available for free (like at Starbucks) and crack their precious Facebook profile!Quick note: This only works if your target is actually browsing through Facebook overhttp(not https) at the time you're doing the hack.How?We are going to use a well known method called "The cookie injection method." This might be far off from becoming "elite," but you need to get familiar with your Linux distribution first.Step 1: Get the Right "Stuff"For this hack, you'll need a few things. Nothing special, but you'll need this stuff. My best suggestion is that you first install BackTrack, Kali Linux, or Bugtraq because they have almost everything we need.For this little magic trick, we'll need:A working Linux distribution (preferably Kali, Backtrack or Bugtraq)Wireshark (a packet sniffer)Firefox (web browser)Nmap (scanner)Greasemonkey (addon for Firefox)Cookie injector (script for Greasemonkey)*Now let's start doing some magic! :D*Step 2: Network ScanFirst, to actually connect to a target, we'll need an IP address. In order to get that, you'll need to do a network scan with Nmap. So go ahead and boot up your terminal and enter the following command:nmap -F 192.168.xx.xx/24Note: If this doesn't work, use10.0.x.x/24instead.This command will scan your network for any IP addresses connected to it. The-Fgives the console the instruction to use "Fast mode." If done correctly, you should see something like this:That's how your Nmap scan should look like.Step 3: Starting the Man-in-the-Middle AttackNow we're going to start a man-in-the-middle attack, MITM for short.An MITM attack is an attack were we spoof our MAC address so that when a server/responding person sends a message to the other, he won't be receiving that message, but he will receive messages that we send, as we're the Man in the middle.This might help you understand:A man-in-the-middle attack!Starting the AttackTo start, enter the following command in a NEW terminal window:sudo echo 1 >> /proc/sys/net/ipv4/ip_forwardThis will forward your IP address. Now we're starting the MITM by opening a NEW terminal window and entering this command:sudo arpspoof -i [Interface] -t [target] [default gateway]If you don't know your interface and default gateway, start a new terminal and enter:ifconfig.This is the result form the arpspoof.Open (once again -_-) a new terminal window and enter the following command:sudo arpspoof -i [interface] -t [default gateway] [target]Another result from the arpspoof!Note: After you entered both the arpspoof commandsDON'T CLOSE THE TERMINALS.Step 4: Firefox and Wireshark (Almost Done!)We need a few more things in order to complete this hack!First installFirefox,thenGreasemonkeyand thecookie injectorscript. Then, install Wireshark, which you can do by entering this command into a terminal window:sudo apt-get install wiresharkAfter that, open up a Wireshark session (open a terminal and entersudo Wiresharkas command). Select your interface and start capturing. At the top, you should see an input box where you can add filters. Now enter this filter:http.cookie contains DATRNow you should get a list in Wireshark. Search for a cookie that contains the text GET. Locate it, click on it with the left mouse button, select copy, select bytes, select printable text only.Wireshark result. The one you need is in the black circle.Now go to Wireshark and go to Facebook. Make sure you're NOT logged in. If you are, go to settings and delete all the cookies. Then go back to the Facebook log-in page, press[ALT]+C, and paste the cookie. PressOKandrefreshthe page.Here you can clearly see the cookie injector script input box.If my magic worked, you should see the main Facebook timeline. If not, then you've done something wrong.My Final CommentsThis hack may seem advanced, but it's actually really easy. Once you break down all the steps, it's a piece of cake! :DNow that you've done this, it should be clear that Facebook security isn't very strong :PGood luck, my fellow hackerians, and I'll see you next time!Don't forget to give kudos andfollow mefor more hacking tutorials. Also, if you have any questions, don't be afraid to ask them!Th3skYf0xWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Hack Any Account That Has Recovery via Phone Option Enabled (SMS) On Android:How To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHow To:Hack LAN passwords with EttercapBecome an Elite Hacker Part 4:Hacking a Website. [Part 1]How To:The Essential Skills to Becoming a Master HackerBecome an Elite Hacker, Part 1:Getting StartedNews:Funniest Hacks in HistoryAdvice from a Real Hacker:The Top 10 Best Hacker MoviesHow To:You Can Play Assassin's Creed Rebellion on Your iPhone Right Now — Here's HowHow To:Hijacking Cookie SessionsHow To:Elevate a Netcat Shell to a Meterpreter Session for More Power & ControlGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow To:Prevent Social Networks from Tracking Your Internet ActivitiesNews:Student Sentenced to 8mo. in Jail for Hacking FacebookCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsThe Social Network Wars:Google+ vs FacebookCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsNews:Get YouTube's New Layout Today with a Simple JavaScript HackHow To:Conceal a USB Flash Drive in Everyday ItemsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsGoodnight Byte:Coding a Web-Based Password Cracker in PythonForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsGoodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)How To:How Hackers Steal Your Internet & How to Defend Against ItSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordMastering Security, Part 1:How to Manage and Create Strong PasswordsNews:The Past Two Days (News Clips), May 31Community Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker Training