From the course: Certified Ethical Hacker (CEH)

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Surveying session hijacking tools

Surveying session hijacking tools

From the course: Certified Ethical Hacker (CEH)

Start my 1-month free trial Buy for my team

Surveying session hijacking tools

“

- There are several tools available, call it off the shelf, for doing session hijack type activities. PortSwigger is available to us. It allows us to proxy web traffic through what is essentially an HTTP proxy. Zed Attack Proxy from OWASP can do something similar. It allows you to proxy HTTP traffic through and extract things like session IDs. HSTS is going to be a problem for you. So HTTP Strict Transport Security is a feature built into various browsers that requires the matching of certificates. Since everything uses transport layer security these days, it can be a problem. If you are using something like Zed Attack Proxy, it is using a certificate that is signed with the ZAP root cert. That root cert needs to be trusted by your operating system and browser. So in order to pull off something like a Zed Attack Proxy in the path type of attack on an actual victim, not in a lab, you would need to get this certificate installed on your victim. Similar with PortSwigger, Burp Suite, you…

Contents