Session Hijacking via Cookies - The Logical Kid

Hello! All. Today I am going to talk something about cookies, (not those which you eat) specifically about authentication cookies.


A brief for those who do not know what cookies are:
Plainly, a cookie is some data which is provided by websites you visit, which stores information about your activity such as logged in, or logged out, and/or your browsing preferences in case you are visiting google, or YouTube, et al.

Did you notice how searching for songs once on google and clicking on the result fetches that result in your next search?
Have you ever wondered how YouTube suggests you 'related' and/or 'recommended' videos?
The answer is, via Cookies.
Hope you understood what cookies are, at least blunt enough.

Okay! So now let me begin with my module wherein I am going to show you where exactly the cookies are actually stored in the browser, and I will later on show you how to use other user's cookies for fun and profit.

Tools required:
* Browser (Mozilla Firefox recommended)
* Account in way2sms (as I am taking example of way2sms here)
* Cookie editing plugin (Cookie Manager) on Firefox



Step 1: Login to your way2sms account. (Lets call it victim's account)

Step 2: Open Cookie Manager and search for cookies from way2sms domain, and look for the parameter 'JSESSIONID'.

Step 3: Copy the value of that parameter from the cookie.

Step 4: Open another browser (probably Chrome, with cookie editor/manager installed) or even a private tab in Firefox will do.

Step 5: Login to another way2sms account, probably any account different from the previous one. (Lets call it attacker's account)

Step 6: Repeat step 2.

Step 7: Change the value of the parameter JSESSIONID of the cookie with the previous value (which you had copied earlier).

Step 8: Reload the page.

Step 9: Provide the login details of attacker's account and login.

Thats it! You will be logged in as the victim instead of attacker.


Alternative method?
Okay! There's another simple method which doesn't involve use of any plugin.

Step 1: Just login as victim.

Step 2: Copy the URL completely:
Example:
http:// site24 . way2sms . com/ebrdg?id=AABDA654EEE776118554CAB2EA9xxxxxxxxxxx

Step 3: Paste this URL in a private tab or in a different browser.

Step 4: Login using the attacker account. (Any account except the victim's account)

Thats it! You will be presented with the session of victim's account instead of yours.



Thats all folks!
Will be back with a new post soon!

Regards,
itsmeRiF


ls -1
echo 0
shut

What I have learnt from the Traffic Signal - The Logical Kid

Hello! All. This post is a well deviated one from my normal Tech posts. The motive behind this is the grass root or the foundation of a successful career in whatever you choose to be in life. Be it a good Engineer, a doctor, a Business Management guy, a salesperson, an artist, or whatever you may choose to be in life.
The foundation is the toughest of all. I'm not blabbering all here, and for those who think that I'm speaking things just because I am jobless at a cold Sunday, mark my words, at the end of this post you too will agree with my perspective.
Now, coming straight to the point about the title of this post? Well, its like I travel about 24kms one way to my workplace (which I cannot reveal though) and that's around 48-50kms of the two-way ride. I find many signals during my journey to-and-fro to/from my workplace. Normally, the roads are clear as half of my route involves Highway and the other is the populous streets of the city where one will experience this long honking from bikes, the auto-walas and the trucks.
Amidst the pollution, the honking, and the 'music' I play in my music-player-cum-Mobile-phone I somehow manage to think subtly at even odd times, something about life, the philosophy, and all those out-of-the-blue content.
Did you see some roads where you have a red signal even when there is no traffic around? Don't you get impatient at the sight of such signals and tend to break the signal as you see nobody on the other side? Not only you, me or anybody else could have the same feeling at that moment which forces you internally to jump the signal as you see no traffic coming towards you, or in your way.  

So what? Now stop preaching as a traffic cop, be straight enough.

Okay, unable to prevent myself from stopping for 5 minutes or say 10 minutes once I jumped the signal without any guilt or sort racing towards my workplace. Sooner at about half a mile later from the signal, I could see, there was a traffic jam and the vehicles were in a bumper-to-bumper sort of traffic jam. I had to wait for about 10minutes for the jam to dismiss and continue my journey again.

So, what does this incident have to do with this post?

Patience, people! You may consider it as a normal incident of Hyderabad traffic jams, and may not co-relate with life.
Let me tell you what my mind 'absorbed' by observing that incident.
Life and your success is related with the traffic signals. You may find it right to jump signals at times when you see there is nobody on the other side, but wait! Your vision is only limited to that 'other side' which is definitely bounded. The traffic cop knows the other side, (thanks to the CCTV team for updating the traffic cop about the traffic) and he warns you (w/ a red light) but you being impatient and not being able to see the actual other side, tend to break the rules.

Same with your career, your success and life. You get a lot of signals at times where you might think to bypass it (as jumping red signal) but will face failure at an intermediate stage (a signal half a mile later).

Life is anyways not a game where you need to win or lose. Its all about playing it well. People never realise the value of life except in terms of the success and the money they earn.
Uhm, one more example just to relate it with people at large, probably the gamers at large.

There is a game series called Grand Theft Auto, well this doesn't need any introduction right? I used to spend lot of time in playing the San Andreas version of the game. Consider the person Carl Johnson (CJ) of that game as you in real life. The game consists of missions and missions where you just keep completing one after the other and then keep earning money to buy things you need. I toiled for completing the game for 2 months playing for about 6-8 hours a day, everyday and finally completed the game (w/o cheatcodes).
After completing the game, I was just happy for sometime because I had completed the game, but what about the other things which were always around me in the game? The Gym, the driving schools, the dresses which I have never bought, the food which I never ate in the game.
To the worse, when I started playing the game with absolute power (God Mode) I was bored in just 30 minutes of Gameplay, but without cheatcodes I could have played much much longer. Life is not about having 'absolute power' or 'everything' (as people wrongly relate it with Money). Its all about the way you interact with the surroundings, the people around you.

Attend a boring event, do something which you hate (for the reason it sounds boring) and you will realise what you have around you which can be done in your life. Do something unique a day, like read a new book, paint something, sing a song, play with your siblings, which you would remember for a lifetime. Trust me, Spending money just because you have sufficient, and you can, will not make you happy. 



For a techie specific post, which focuses on the lack of patience in people from Techie background, read this:
http://www.unhappyghost.com/2015/07/in-response-to-open-letter-from-unemployed-engineer.html



That's all for now, will come up again when I get hit by a thought someday sooner or later.


Regards,
itsmeRiF