Ravindra BagaleCourses & study guides

41. Session Hijacking – Tokens, Cookies and Defence

41.5 Network Sniffing of Sessions – Host-Only Concepts

By Last updated:

On a switched LAN, casual sniffing is harder than old hubs – but open Wi-Fi, misconfigured mirror ports, compromised routers, and MITM themes still teach why cleartext cookies die.

Lab-safe learning:

  • Wireshark / tcpdump on host-only interface while your lab browser talks HTTP to your PHP VM
  • See Cookie: headers in clear HTTP; contrast with TLS (payload encrypted)
  • Blue push: HTTPS + HSTS (Strict-Transport-Security) so browsers refuse downgrade
# Kali host-only – capture ONLY your lab subnet traffic (example interface name varies)
# sudo tcpdump -i eth1 -n host 192.168.56.40 and port 80 -w /tmp/lab-http.pcap
# Then open pcap in Wireshark; filter: http.cookie || http.set_cookie
# Never capture on bridged café Wi-Fi hunting strangers
Red team (attacker) does Blue team (defender) detects / stops
Captures HTTP Cookie on open Wi-Fi / MITM lab HTTPS + HSTS; Secure cookies; VPN on untrusted nets
SSL-strip / downgrade themes (awareness) HSTS preload where appropriate; no HTTP links to auth
Compromises home router to sniff LAN Router hardening; segment IoT; update firmware

Ravindra Bagale's Tip

Students run Wireshark on college Wi-Fi and call it "research" – a legal and ethical red flag. Only host-only lab VM traffic. Interview: "I demonstrate cookie exposure on my lab HTTP app, then enforce HTTPS." Now let's move on.

Lab

Start tcpdump/Wireshark on Kali toward 192.168.56.40:80 only. Login on weak HTTP PHP app. Confirm Cookie visible. Switch lab app to HTTPS (self-signed), re-login, confirm payload not readable as clear Cookie in same way. Screenshot ethics note in lab book.