1 Users appreciate this thread.
angelrulez7 (2014-03-29 04:03:52)I believe the only cookie I have on Comm is "token", which is impossible to access unless you guess, so I think I'm safe.
a
SPCOxion (2014-03-31 19:12:12)Thanks, @Mega.
But it does look a little, er, dumber now.
"How it is done"
As for the website, no. The only website I know of is/was iSEclipse, and they shut it down.
angelrulez7 (2014-04-05 04:55:47)Ah, I'm safe. I have "uniqhash", which is super hard to get, as the cookie.
My password, which you can't see. show
This post has been edited one or more times, the last time was:2014-04-05 04:58:22
a
angelrulez7 (2014-04-08 07:54:24)LOL. I would never really put my personal info in an unopenable spoiler for the sake of source viewing.
a
ddddd
CoolApps (2014-04-20 10:53:54)My site is protected against cookie hijacking completely using my method, really effective as well, it also helps a few other things.
And SPCO, iSE never went down because of that reason LOL.
BTW, now we know that you did it, it's safe to say that your site is SQL injectable.
This post has been edited one or more times, the last time was:2014-04-20 20:00:58
Newer account: NodePoint
CoolApps (2014-04-20 11:13:48)Just to add to this guide, DON'T use MD5 as an encryption method, there are many software which can easily crack MD5, SH1 and such, use a much secure encryption.
Newer account: NodePoint
CodyP2000 (2014-04-20 12:36:48)SPCOxion, Really? Haven't you done enough?
[CLOSE REQUEST]
=+=Home4DSi Community Manager=+=
Want to talk to me somewhere else?
Kik: CodyP2000
Facebook: Cody Pietrowski
Snap: testedsnake201
Email: [email protected]
Want to talk to me somewhere else?
Kik: CodyP2000
Facebook: Cody Pietrowski
Snap: testedsnake201
Email: [email protected]
CoolApps (2014-04-21 09:39:31)↑ LOL
This post has been edited one or more times, the last time was:2014-04-21 16:39:49
Newer account: NodePoint
SPCOxion (2014-04-22 01:17:53)I didn't make this thread to attack Misdew or threaten you.
This isn't a place for you guys to throw your meaningless threats at me; Get over it.
This topic is closed, so you can not post a comment.
Back to forum: Web Programming (HTML, JS, CSS, PHP, MySQL)
New registered users today: 7
Newest registered user: ElegantVulpes
Wanna learn an easy way to hijack sites? You've come to the right place.
It depends on what the websites uses cookies for, so this is usually used to get into other people's accounts.
Here's a quick warning for you: This will not work on every website. If the website developer is smart, then they'll use encryption keys or hashes on their cookies to keep you from using this method.
2. Google Chrome
3. A cookie editing plugin
You can get a cookie editor for Google Chrome by simply looking for one on Google.
The first thing you want to do is register and log in. Make sure that you set it to "remember me", otherwise you won't have any cookies to edit.
Open up your cookie editor (it should be on the top-right hand side of the screen), and look for one that says 'username'.
Click on it, and pray to Gpd that the sote didn't use anythong to protect it. If they did, you can't use this method.
If they didn't, then change the value of the cookie to the username of whoever you want to hijack, then hit send.
If that all worked, then good job.
Very simple.
Instead of storing ine cookie, you're going to store two: One for the username, and one for their user ID.
(if you don' have a user id, then you need to fix that.)
You won't encryot or hash the username before putting it in a cookie, but you will hash the ID.
When someone tries to view a page, then use this bit of code before anything else:
$username = $_COOKIE['username']; $id1 = $_COOKIE['id']; $query = "SELECT id FROM users WHERE username='$username'"; $query_run = mysqli_query($connect, $query); $id2 = md5($query_run); if($id1 != $id2){ header("Location: logout.php"
Then just delete the cookies in logout.php.
2014-03-29 02:46:38