Total Pageviews

Wednesday, 8 April 2020

firesheep

A Firefox extension that demonstrates HTTP session hijacking attacks. 


Use the 'stable' branch (requires Firefox 3.x) instead!

A Firefox extension that demonstrates HTTP session hijacking attacks.
Created by:
Contributors:

Building

Start by grabbing the code using Git. If you're planning to contribute, fork the project on GitHub.
$ git clone https://github.com/codebutler/firesheep.git
$ cd firesheep
$ git submodule update --init
See instructions for your platform below. When done, an xpi will be created inside the build directory. Load the extension into Firefox by dragging it into the Addons page.

Mac OS X

  1. Install build dependencies using Homebrew (brew install autoconf automake libtool boost).
  2. Run ./autogen.sh
  3. Run make!

Ubuntu Linux

  1. Install build dependencies (sudo apt-get install autoconf libtool libpcap-dev libboost-all-dev libudev-dev).
  2. Run ./autogen.sh then make.

Windows

This has so far only been tested on Windows XP (32-bit), however the binaries work fine on Windows 7 too. If you can help simplify this process please let me know.
  1. You'll need Microsoft Visual Studio 2005. The express edition should work too, but this hasn't been tested. Newer versions of Visual Studio should also work, but the Makefiles might need a bit of tweaking. Patches in this area greatly appreciated.
  2. Install Cygwin, selecting the following packages: automake-1.11, gcc-g++.
  3. Install BoostPro. Choose Visual C++ 8.0 and Multithreaded debug, static runtime.
  4. Install WinPcap.
  5. From a Cygwin command prompt: Run ./autogen.sh then run make!

---

Firesheep

A Firefox extension that demonstrates HTTP session hijacking attacks.

System Requirements

  • Mac OS X: 10.5 or newer on an Intel processor.
  • Windows: XP or newer. Install Winpcap first!
  • Linux: Not currently supported.
  • Firefox: 3.6.12 or newer. 32-bit only. Firefox 4.x beta not supported.

Download

Getting Help

----

Firesheep

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.
It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.
This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.
Today at Toorcon 12 I announced the release of Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.
After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.
As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:
Double-click on someone, and you're instantly logged in as them.
That's it.
Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.
Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.

Posted by at
Labels: