danmcinerney / cookiejack Goto Github PK

As you probably know by know I am a developer for the archassault project and we would like to distribute this tool. However I noticed its missing a license file, I checked the readme and the py file itself. If you arent ready for this to be distributed thats fine I will keep an eye and check back with you at a later date.

Thanks
Tyler

When inserting multiple cookie values the server will send a response, but the browser will never load the page since the attacker's machine never seems to send TCP ACKs back to the server to let it know that its received data. Wondering if this has something to do with sequence numbers or the handshake. The modified packet is identical to modified packets from tools like Burp suite or Tamper Data firefox extensions so I'm not sure why it's failing.

This script works by running a sniffer in one thread sniffing the victim's traffic, the main thread continuously ARP poisoning the victim, and another thread to intercept and modify the outgoing requests of the attacker should the request be to a site that cookiejack has stored the cookie data from. The actual injection and modifications are on line 139 for those interested.

About the only time I can get this to work is if you strip out all the cookie data except for the most important, like PHPSESSID=98f4389f489fh438. Otherwise the attacker's machine won't load the page.