This document discusses session hijacking, including the 3-way handshake in TCP, types of session hijacking like predictable tokens and man-in-the-middle attacks, methods for hijacking a session by sniffing packets and predicting sequence numbers, mitigations like HTTPS and VPNs, tools for hijacking sessions including Firesheep, and provides a link to download Firesheep.

2. TOPICS
 TCP Concepts-The 3 Way handshake
 Session hijacking
 Types
 Method
 Mitigations
 Tools
 Firesheep

3. The 3-way Handshake

4. What is Session Hijacking ?
 Session hijacking is when
an attacker gets access to
the session state of a
legitimate user.
 The attacker steals a valid
session ID which is used to
get into the system and
retrieve the data

5. 3-Way Handshake

6. Session Hijacking

7. Session Hijacking

8. This is Spoofing not Hijacking

9. This is Hijacking

10. Types Of Session Hijacking
 Predictable session token
 Session sniffing
 Client side attacks (XSS, malicious JS codes, trojans
etc)
 Blind Hijack
 Man-in-the-middle (MITM)

11. Method (steps)
 Place yourself between the victim and the target
(you must be able to sniff the network)
 Monitor the flow of packets
 Predict the sequence number
 Optionally kill the connection to the victim’s machine
 Take over the session
 Start injecting packets to the target server

12. Mitigations
 Use a secure HTTPS protocol
 Use a VPN when connecting remotely
 Protect access to your own networks
 Limit exposure to untrusted networks
 Educate the employees

13. Tools
 Juggernaut
 Hunt
 TTY Watcher
 IP Watcher
 T-Sight
 Parros HTTP Hijacker
 DroidSheep for Android
 Firesheep (Firefox addon)

14. Firesheep
 Firesheep is a
free, open source, and
is now available for Mac
OS X and Windows.
 Linux support is on the
way.
Find it here-
https://github.com/codebutler/firesheep/download
s