+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Is Facebook cookie hijacking still possible? (/showthread.php?tid=5661813)
Is Facebook cookie hijacking still possible? - Mironinja4 - Jul 4, 2017
Today I tried the next experiment: I logged into my FB account, I copied all my cookies, then I logged out of it.
Next, I inserted all the cookies one by one into my browser then refreshed the page, hoping that I'll be logged into my account, but I wasn't, which was weird, because this used to work.
So my question is: is it still possible to cookie hijack Facebook accounts?
* - andmuchmore - Jul 4, 2017
There are advanced phishing tools to do this but you can't just copy cookies.
Check out Evilginx, it even supports 2FA
* - PerfectStorm - Jul 4, 2017
Why not simply keylog the password?
* - Mironinja4 - Jul 5, 2017
Why would I keylog my password? I'm not trying to hack somebody else, I'm trying to access my own account without the password.
* - adios1 - Jul 5, 2017
i think it doesn't work anymore in https sites specially on facebook. the security level nowadays is high. i would suggest to just use keylogger and use acc's password
* - andmuchmore - Jul 5, 2017
Did you have your password saved in your browser at all?
* - C4STRO - Jul 6, 2017
Your session gets destroyed after you log out of Facebook, so your cookies aren't valid anymore.
* - Zixem - Jul 6, 2017
(Jul 4, 2017 07:22 AM)Mironinja4 Wrote: Today I tried the next experiment: I logged into my FB account, I copied all my cookies, then I logged out of it.
Next, I inserted all the cookies one by one into my browser then refreshed the page, hoping that I'll be logged into my account, but I wasn't, which was weird, because this used to work.
So my question is: is it still possible to cookie hijack Facebook accounts?
https://www.youtube.com/watch?v=5OfwhGQONbg
* - Mironinja4 - Jul 6, 2017
I see you don't know how cookies work.
Let's say you log into an account (Yahoo mail, let's say) on a laptop at your home, then you go to another place with internet and you open up Yahoo mail again on that laptop, you'll still be logged into the account, but how does Yahoo know that it's you even though you changed your IP? Through cookies.
* - H4x10r - Jul 6, 2017
2 Ways to get the cookies.... XXS server side Stored or Reflected , so send a logged in User a link to a site with an prepared xss that is asking for the cookie values
or as above
keyloger or a rat bot .... the better way in my eyes sure u want to login to your own account ....
and it is possible to sniff cookies if they are not set to secure and httponly
so there is a way but not for facebook
they have set them to secure and httponly and added hsts , the certificate is crypting everything.
no way to crack this .
* - cryptovenger - Jul 8, 2017
Yeah, Session Hijacking is still possible for facebook, but that requires knowledge about wireshark and ettercap.
* - FormerlyS - Jul 9, 2017
As another user said, don't "log out" on facebook on computer 1, as that invalidates your cookies. Just close the browser and copy the cookies to the other pc and you'll see it works.
* - Meloz - Jul 9, 2017
(Jul 9, 2017 10:21 AM)FormerlyS Wrote: As another user said, don't "log out" on facebook on computer 1, as that invalidates your cookies. Just close the browser and copy the cookies to the other pc and you'll see it works.This, and what the other user said, Facebook obviously deletes the session you are logged into once you logout the account. It's not possible, unless you don't sign out.
* - iExploits - Jul 15, 2017
Yes, it is still possible, but not without some work. For example, I am able to use my session data from my laptop and use it on my desktop without logging in. But of course, this requires some hard work.
* - FormerlyS - Jul 16, 2017
(Jul 15, 2017 08:41 PM)iExploits Wrote: Yes, it is still possible, but not without some work. For example, I am able to use my session data from my laptop and use it on my desktop without logging in. But of course, this requires some hard work.
"Some hard work" what? Please explain to me what you mean by this