Writing Handlers

kensaggy edited this page Feb 14, 2012 · 5 revisions

Firesheep works by sniffing http requests that include the cookie values for specific websites. In order to create new handler you first need to discover which cookie is used by the website to identify you.

#Discovering which cookie is required Download a plugin that will allow you to edit and delete cookies from your browser. (FireCookie for firefox is good or "Edit This Cookie for Chrome" is good) Go to webpage you want to hijack. Remove one cookie at a time then refresh the page to see if you are still logged in. If you delete the session cookie it will look like you're logged out. add the cookie back and try a different cookie. Repeat for all cookies. Sometimes you'll need multiple cookies to identify yourself to the website, so take a note of each cookie that logs you out.

#Create your handler Find your handlers directory: (TODO add path for Windows)

  • Under OSX: ~/Library/Application Support/Firefox/Profiles/[your Profile]/extensions/firesheep@codebutler.com/handlers/

Create a file in the handlers directory named website.js (replace website with the url you're using)

Add the following code to the js file you just created.

register({
  name: 'website.com', //the name that will show up in the Firesheep sidebar
  url: 'http://www.website.com/', //the website url that Firesheep will match on
  icon: 'http://website.com/images/favicon.gif?2', //a full path to a favicon if the favicon isn't in the default location (optional)
  domains: [ 'website.com' ], //the actual domain that Firesheep will look for in the request
  sessionCookieNames: [ 'cookie1', 'cookie2' ], //a list of cookie key names that firesheep will intercept and send on 
                                                                     //your behalf (this should be the list of cookies you noted in the previous step)

  identifyUser: function() { //Firesheep can make a request to discover some information about the cookie (username and avatar) for the buddy list
    var site = this.httpGet(this.siteUrl); //this will pull down a page that contains the value for the username and avatar
    this.userName = site.body.querySelector('input#user_email.text_field').value; //use a query selector to pull out the username from the page (optional)
    this.userAvatar = resp.body.querySelector('#navAccountPic img').src; //another query selector to grab the image (optional) 
  }
});

That's about it. Restart Firefox to make sure Firesheep picks up your new handler. Then as you tweak your handler simply stop and restart Firesheep from intercepting and it'll pick up your changes.

Clone this wiki locally
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.