6. What are session cookies? How they used to hack email accounts?

Once again welcome back a very interesting article about Session Cookies, which many hackers claiming to have used to hack email accounts or password of several other websites. In this tutorial you will learn how to hack yahoo account using session cookies.

Before we start any further let all you know what these session cookies are… sometimes which called Magic Cookie or Session ID?
However, if we try go in deep, there can be written whole article about these session id’s but in simple ways… these are the string stored when we tends to login our account. But with unfortunate with hackers luck these strings have very short span of life i.e. gets automatically deleted after a set period of time. Now the question where these strings are stored -  In any situation there are only two places where these keys gets stored first one is itself the server and the second one is the browser cookies. And the destruction takes place at three ways first is when you close your web browser, second is when you sign out of your account and third is if you left your account open for more than 20 minutes idle.

How this Cookies accessed on Local System?

As in this article we are using Yahoo account, so to get understand what this cookie is first you need to open yahoo.com and login to your account. After that you have login to yo ur account copy the below code written in bold and then paste in browser address bar.

javascript:alert(document.cookie);

This will open a popup box with a text something like this which is just not able to understand but we even not need to do so.. as only we need this code only.

Now create one fake account on yahoo.com and login in that account and retrieve the cookie in same manner and notice the changes in session ID’s.

Now come to the main point hacking using the session ids…. For hacking the session cookies we first need the session cookies of the victim and its quite simple to get the session cookies of the victim. You just need to send him one link as soon as he clicks on that we will get his session cookie.

Here you should note this point as we have already mentioned that session hacking removes the authentication on the server as we have the AUTO LOGIN cookie. In this type of attack when victim sign out , then hacker will also sign out. But in case of YAHOO its little bit different, when victim signout but attacker still have the access to his account. Yahoo maintains the session for 24 hours and then destroy the session ID’s from its server.

Now how to step further to steal Session Cookies … follow the steps behind…

1. Go to the Website and register there:

http://www.my3gb.com/register.jsp

2. Download the Cookie stealer files:

http://www.mediafire.com/?q4oo0encvhtxoa1

3. Now upload the four files on the website and create one empty directory naming Cookies as shown below:

4. Send the link of yahoo.php to victim. Now what will happen when user clicks on the yahoo.php is that its cookies are get stored into directory Cookies and simultaneously he is redirected to his account.

5. Now open the link Hacked.PHP to access the cookies. In my files the password is “password”. You need to put that to access the files.

6. You must have got the username of victim’s account. Simply Click on it and it would take you to inbox of victim’s yahoo account without asking for any password.

Now it doesn’t matter if victim signs out from his account, you would remain logged into it. 

Note: You can try this attack by using two browsers. Sign into yahoo account in one browser and run the code. Then sign in through other browser using stolen session.