Today I tried the next experiment: I logged into my FB account, I copied all my cookies, then I logged out of it.
Next, I inserted all the cookies one by one into my browser then refreshed the page, hoping that I'll be logged into my account, but I wasn't, which was weird, because this used to work.
So my question is: is it still possible to cookie hijack Facebook accounts?
There are advanced phishing tools to do this but you can't just copy cookies.
Check out Evilginx, it even supports 2FA
DO NOT DEAL WITH THIS MEMBER
Why not simply keylog the password?
Why would I keylog my password? I'm not trying to hack somebody else, I'm trying to access my own account without the password.
i think it doesn't work anymore in https sites specially on facebook. the security level nowadays is high. i would suggest to just use keylogger and use acc's password
Did you have your password saved in your browser at all?
Your session gets destroyed after you log out of Facebook, so your cookies aren't valid anymore.
(Jul 4, 2017 07:22 AM)Mironinja4 Wrote: Today I tried the next experiment: I logged into my FB account, I copied all my cookies, then I logged out of it.
Next, I inserted all the cookies one by one into my browser then refreshed the page, hoping that I'll be logged into my account, but I wasn't, which was weird, because this used to work.
So my question is: is it still possible to cookie hijack Facebook accounts?
https://www.youtube.com/watch?v=5OfwhGQONbg
O o
/¯/_____________________________________/¯¯
| 0x41414141 ~~~
\_\¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ ¯\__
/█\
/ \
Jul 6, 2017 10:37 AM
(This post was last modified: Jul 6, 2017 11:08 AM by Mironinja4.)
I see you don't know how cookies work.
Let's say you log into an account (Yahoo mail, let's say) on a laptop at your home, then you go to another place with internet and you open up Yahoo mail again on that laptop, you'll still be logged into the account, but how does Yahoo know that it's you even though you changed your IP? Through cookies.
2 Ways to get the cookies.... XXS server side Stored or Reflected , so send a logged in User a link to a site with an prepared xss that is asking for the cookie values
or as above
keyloger or a rat bot .... the better way in my eyes sure u want to login to your own account ....
and it is possible to sniff cookies if they are not set to secure and httponly
so there is a way but not for facebook
they have set them to secure and httponly and added hsts , the certificate is crypting everything.
no way to crack this .
Mich jagen Großfamilien und das LKA.
&
Deine Mudda verkauft Winrar Lizenzen im Darknet.
Yeah, Session Hijacking is still possible for facebook, but that requires knowledge about wireshark and ettercap.
As another user said, don't "log out" on facebook on computer 1, as that invalidates your cookies. Just close the browser and copy the cookies to the other pc and you'll see it works.
DO NOT DEAL WITH THIS MEMBER
(Jul 9, 2017 10:21 AM)FormerlyS Wrote: As another user said, don't "log out" on facebook on computer 1, as that invalidates your cookies. Just close the browser and copy the cookies to the other pc and you'll see it works. This, and what the other user said, Facebook obviously deletes the session you are logged into once you logout the account. It's not possible, unless you don't sign out.
Yes, it is still possible, but not without some work. For example, I am able to use my session data from my laptop and use it on my desktop without logging in. But of course, this requires some hard work.
I've been hacking Facebook and Gmail for 7 years. I have used exploits to gain access to many FB, IG, etc accounts without user's password.
If you’re serious about getting the job done, PM me about websites, accounts and databases.
(Jul 15, 2017 08:41 PM)iExploits Wrote: Yes, it is still possible, but not without some work. For example, I am able to use my session data from my laptop and use it on my desktop without logging in. But of course, this requires some hard work.
"Some hard work" what? Please explain to me what you mean by this
|
