It Security demonstration - Hacking Facebook using Man-in-the-middle attack and XSS

1. Hacking Facebook Stefan FODOR(backb0ne fl00d3r ) 17 th of May Vlad ZAHAN

3. Man-in-the-middle-atack

4. Hacking no 1 (ARP poisoning)

5. Hacking no 2 (Firesheep)

6. XSS

7. Facebook applications

8. Hacking no 3 (XSSing)

9. Questions?

13. Last login

14. Autologin (“remember me” box)

15. Cookie jar

16. Men in the middle attack

18. Wireshark authentication cookies

19. Modify existing cookies

20. Refresh the page

21. Wanna see a demo?

22. Firesheep

24. Security vulnerability of web applications

25. Inject code into the webpage

27. Created by third-parties

28. Some sort of social-coding?

30. Useful

31. Fun

32. Entertaining

33. Challenging

34. ...vulnerable to XSS!

35. XSSing Facebook http://apps.facebook.com/flixville/search/?locale=US&searchText=%22%3E%3Cfont%20size=70%20color=red%3EStefan%20said:%20Greetings%20Morten!

37. Send it to a server

38. Store the cookies

39. Have fun!

40. In theory this should work...

41. Questions?

43. http://codebutler.com/firesheep

44. https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

45. http://www.xssed.com/mirror/59032/