In this tutorial , I will explain the process of side jacking using some tools while the main tools are :
- Hamster
- Ferret
NOTE : Although signs such as additional e-mails in the ‘sent’ folders might give a clue.
Contents
- Preparations
- Starting Up
- Using the console
Side Jacking with Hamster and Ferret
Hamster is our wizard.So we will start capturing the cookie and then using them to get into the victim's session. So starting with Hamster :
Part A : Preparations to Set UP for Attack
- Download Hamster and Ferret tools.
- These are command line tools means we can make them work using some instructions on command prompt ,but those who are afraid of command line, dont worry, u wont have to do much.
- Unzip these into a directory which you can access easily e.g. C:\side-jacking
Note : There is one major problem with the Intel® PRO/Wireless 2200BG and some other intel adapters: it doesn’t do promiscuous mode. This means that unlike most other wifi adapters, you can’t use it for sidejacking. To get around this, you would need to buy a cheap USB wifi adapter (usually 1000 rs)
- First of all to make sure that you’re at browser’s proxy to Hamster, which will be on port 3128.
- I will strongly recommend that DON’T use your normal browser, because Hamster will totally screws up the cookies in the browser. So must take the following three precautions ,which i took while using it :
- I used Internet Explorer for side jacking, as Firefox is my default browser
- Secondly I created a second account called “hamster” in my computer, and did the whole task from that account and then I deleted it.
- Next I used the alternate “profile” feature of Firefox to have two profiles running at the same time to feel easy.
I think you didn't get the third step, okay I am gonna explain it:
- Firefox allows two profiles to be running at the same time. You can easily launch them from the command line as follows:
- You will have to use these at c:\Program Files\Mozilla Firefox\
- After using these commands, the following screen will popup
- Click on create profile, give any name.. Next time u start Mozilla use that one for hamster.
- Now open your created profile in Firefox, go to the Tools / Options. Select the Advanced Tab and open Network Tab under it.
- Now Under connections click on settings. Now set up as following:
Set your proxy as shown and click ok.
Part B. Starting Up
- Now we have to run Ferret,so open command prompt
NOTE : I will recommend to do Side Jacking In administrator mode.
- Now goto ferret directory (C:\side-jacking) and type ferret-W.
- Now choose your WiFi or LAN interface (u can try using the company names or try again)
- Now in command prompt type ferret.exe –i to start sniffing cookies e.g ferret -i 4
NOTE : You might also want to capture packets at the same time:
ferret.exe –i 4 sniffer.mode=most sniffer.directory=\pcaps
- The advantage of sniffing packets at the same time is that you can later replay them through Ferret in order to generate a hamster.txt. The cookies last for a long time.
- To run a packet capture, do something like: ferret -r \pcaps\sniff-2007-08-04-eth.pcap
- Open another command prompt without closing the previous one ( Run as Administrator necessary)
- Go to hamster directory(C:\side-jacking)
- Now type 'hamster' and enter to start hamster proxy.
- Now if you have already done the browser configuration as above move on to next part else set the browser proxy to 127.0.0.1 port 3128.
Part C. Using it!!
- Open your configure browser and go to http://hamster/ remember don't put . com or www in the name.
NOTE : If you get server not found, you didnt set proxy correctly or you didnt start hamster in cmd.
- If you are doing everything correctly, you will get this :
- As Ferret is running in the background, it will be updating this list. You’ll need to manually refresh it to see if any information has been added.
- In the right-hand window, you’ll get a list of targets. Most targets will have just the IP address. Some will have additional identifying information that Ferret finds.
- This identifying information is only names associated with the IP address, it’s not cookie information.
- When you click on an IP address, you “clone” it. At this point, all the cookie are set for that IP address.
Keep in Mind – A lot of problems people have is because they set the current IP address to something else, thereby erasing the cookies of a site they want to access.
- Cloning an IP address by clicking on it will cause the window to the left to be filled in, as in the following example:
- You have three options here.
- You can view the raw cookies for this IP address (discussed below).
- You can click on a URL that has a HIGHER probability of being Sidejacked.
- Or you can choose from the URLs below, which have a lower probability of being Sidejacked.
- At this point, just click the URL. For example, I clicked on the http://slashdot.org URL in the above example, and the following window popped up:
- The name “side jacking” in the mid-left of that screenshot is because I created a test account with the username of “side jacking”. This shows how I’ve successfully cloned the cookies to get to that Slashdot account.
- And here is the Facebook account:
FootNotes:
- When things work well, its point-and-click. They don’t always work well.
- The first thing that sucks is you have to figure out which interface to sniff on and make sure that you have a proper wifi adapter.
- I recommend downloading Wireshark and make sure that you’ve got the packet sniffing working with that product before you start Ferret.For more help on Wireshark read How to Bypass Firewall using Wireshark .
- Both Ferret and Hamster will crash or hang. You’ll be restarting the programs a lot. Right now, Ferret overwrites ‘hamster.txt’ every time it restarts, so if you’ve got a good session, make copies of it (or log to sniffer files, and recreate it).
- The Hamster proxy is really slow. You’ll click on a link and have to wait patiently sometimes. Check the Hamster console window in order to see what’s going on.
- Cloning sites is finicky. Sometimes you have to choose the right URL from the list, and choosing the wrong URL will cause the server to reset the cookies, locking you (and the original person) out from the account until a re-login. It takes practice to figure out what you can, and cannot, clone.
- Finally, when the original session cookies expire, you can’t clone them. This is rarely a problem in a live environment, but if you work from capture files, it becomes more difficult.
