Firesheep: Easy HTTP session hijacking from within Firefox • Hacker News Board

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#11

Post by AlexRodriguez » Mon, Oct 25, 2010, 1:31 AM UTC

Works for me.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#12

Post by atomical » Mon, Oct 25, 2010, 1:34 AM UTC

Is there another application besides the FF extension to dump the packets and process them? How does this work?

EDIT: Sorry, I asking specifically how this FF extension works.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#13

Post by Groxx » Mon, Oct 25, 2010, 1:34 AM UTC

Nice. A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere.

That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#14

Post by gasull » Mon, Oct 25, 2010, 1:35 AM UTC

EricButler wrote: post #8

gasull wrote: post #6

I couldn't install it on FF 3.6.9 on Windows XP.

What was the error?

"Firesheep 0.1 could not be installed because it is not compatible with Firefox 3.6.9."

And yes, WinPcap is installed. I don't think it should matter, but I'm running Windows XP on a VirtualBox.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#15

Post by marcuswestin » Mon, Oct 25, 2010, 1:35 AM UTC

The sidebar is not showing up for me after installing and restarting.

Firefox 3.6.11 OS X 10.6 firesheep-0.1-1.xpi

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#16

Post by wwortiz » Mon, Oct 25, 2010, 1:35 AM UTC

leftnode wrote: post #5

I thought the title of this submission was slightly misleading. This is not a security vulnerability from within Firefox, it's a Firefox plugin to reveal security vulnerabilities in a wide range of websites.

To be fair that is exactly what I got out of the title and not that it was using Firefox vulnerabilities.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#17

Post by EricButler » Mon, Oct 25, 2010, 1:38 AM UTC

gasull wrote: post #14

EricButler wrote: post #8

Earlier quoted context omitted.

What was the error?

"Firesheep 0.1 could not be installed because it is not compatible with Firefox 3.6.9." And yes, WinPcap is installed. I don't think it should matter, but I'm running Windows XP on a VirtualBox.

Oh, you just need to update to the latest version of Firefox (3.6.11). Your version is out of date and not secure. http://www.mozilla.org/security/known-vulnerabilities/firefo...

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#18

Post by EricButler » Mon, Oct 25, 2010, 1:40 AM UTC

atomical wrote: post #12

Is there another application besides the FF extension to dump the packets and process them? How does this work? EDIT: Sorry, I asking specifically how this FF extension works.

Wireshark is a very popular open-source tool. http://www.wireshark.org/

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#19

Post by sandipagr » Mon, Oct 25, 2010, 1:40 AM UTC

marcuswestin wrote: post #15

The sidebar is not showing up for me after installing and restarting. Firefox 3.6.11 OS X 10.6 firesheep-0.1-1.xpi

view -> sidebar -> firesheep

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#20

Post by meelash » Mon, Oct 25, 2010, 1:41 AM UTC

Wow, good work. And pretty scary- imagine what one could do with this on any college campus.