+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Article about Facebook session cookie (/showthread.php?tid=6092011)
Article about Facebook session cookie - Mai_saasaa - Jul 2, 2020
https://www.google.com/url?sa=t&source=web&rct=j&url=https://medium.com/swlh/adventures-with-facebooks-session-cookie-3a6e10783070&ved=2ahUKEwiTppXkkK_qAhUL1BoKHX4BDEMQjjgwAHoECAUQAg&usg=AOvVaw0649iNAYRhJXygCu088Ebz
This article is about facebook session cookie, the second half of the article is about assuming xs cookie of c_user but no tools are mentioned for such mission
Any ideas about how we can do that effectively?
RE: Article about Facebook session cookie - linkinpork - Jul 2, 2020
(Jul 2, 2020 10:58 AM)Mai_saasaa Wrote: https://www.google.com/url?sa=t&source=web&rct=j&url=https://medium.com/swlh/adventures-with-facebooks-session-cookie-3a6e10783070&ved=2ahUKEwiTppXkkK_qAhUL1BoKHX4BDEMQjjgwAHoECAUQAg&usg=AOvVaw0649iNAYRhJXygCu088Ebz
This article is about facebook session cookie, the second half of the article is about assuming xs cookie of c_user but no tools are mentioned for such mission
Any ideas about how we can do that effectively?
The article just proves that you can't do an MITM cos Secure flag is present, you can't use XSS because it's got HTTPOnly, and you can't bruteforce it because it's going to take a long time and the session token changes over time because of a timestamp.
That's why there are no tools.
RE: Article about Facebook session cookie - komple3ikos - Nov 1, 2021
(Jul 2, 2020 10:58 AM)Mai_saasaa Wrote: https://www.google.com/url?sa=t&source=web&rct=j&url=https://medium.com/swlh/adventures-with-facebooks-session-cookie-3a6e10783070&ved=2ahUKEwiTppXkkK_qAhUL1BoKHX4BDEMQjjgwAHoECAUQAg&usg=AOvVaw0649iNAYRhJXygCu088Ebz
This article is about facebook session cookie, the second half of the article is about assuming xs cookie of c_user but no tools are mentioned for such mission
Any ideas about how we can do that effectively?
What is your means of access? Do you have physical access? Do you have an admin account on that PC?