How Firesheep Can Hijack Web SessionsFiresheep is a Firefox extension used to hijack web sessions, usually used over WiFi networks. Firesheep doesn't steal usernames and passwords, instead it copies session cookies used on authenticated websites. These are then used to impersonate the hijacked connection. Session hijacking, or sidejacking is a well known problem, ranking 3rd on OWASP's (Open Web Application Security Project) Top 10 Application Security Risk list. Attackers using Firesheep just need access to network traffic -- such
2 of 10
To use Firesheep, a network interface must be selected, In this case, the wireless adapter is selected. As a safety measure, most Windows wireless driver software won't allow the NIC to be put into promiscuous mode (which allows it to capture all packets seen by the NIC) including this IntelPRO/Wireless 8954ABG adapter. Linux OS's are often more flexible and drivers can put the NIC in promiscuous mode if the hardware supports it.
Firesheep Simplifies Stealing Logins
Firesheep Exposes Need For Encryption
2 of 10