TCP session hijack : sessionlist

about sessionlist

https://github.com/iamrage/sessionlist

I was able to compile sessionlist on Fedora 18. I , however , can not compilse that on ubuntu 12.04..

Here are logs including trial and error.

[ install sessionlist on Fedora 18 ( success ) ]

999  git clone https://github.com/iamrage/sessionlist.git 1000  cd sessionlist/ 1006  yum install -y libpcap-devel 1007  make

[root@f18 sessionlist]# locate libpcap.so /usr/lib64/libpcap.so.1 /usr/lib64/libpcap.so.1.3.0 [root@f18 sessionlist]# locate libncurses /usr/lib64/libncurses.so /usr/lib64/libncurses.so.5 /usr/lib64/libncurses.so.5.9 /usr/lib64/libncursesw.so /usr/lib64/libncursesw.so.5 /usr/lib64/libncursesw.so.5.9 [root@f18 sessionlist]# locate libpthread.so /usr/lib64/libpthread.so /usr/lib64/libpthread.so.0

usage

./sessionlist [eth number] [port number]

[root@f18 sessionlist]# ./sessionlist p10p1 80 *************************************************** sessionlist v1.0 *************************************************** c0ded by rage *************************************************** Current hijacked sessions: 1 out of 7 tracked sessions Found data for Host:  ad.jp.doubleclick.net Found data for Host:  fls-fe.amazon.co.jp

if sessionlist can hijack TCP sessions , logs will be outputted in sessions.txt file.

[root@f18 sessionlist]# tail -f sessions.txt Session 0 of 5 - IP: 192.168.11.100 IP: 176.32.120.142 - payload elements: 2 Host:  www.amazon.co.jp user-agent:  Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0 cookie:  x-wl-uid=1mAKbfgI6NBpx <snip>

[ install sessionlist on ubuntu 12.04 ( fail ! ) ]

root@ubuntu1204-vm1:~# git clone https://github.com/iamrage/sessionlist.git root@ubuntu1204-vm1:~# cd sessionlist/

error

root@ubuntu1204-vm1:~/sessionlist# make g++ -march=native -O2 -pipe main.cpp sessionlist.cpp -lpcap -lpthread -lncurses -o sessionlist && strip sessionlist In file included from main.h:25:0,                 from main.cpp:21: sessionlist.h:24:18: fatal error: pcap.h: No such file or directory compilation terminated. In file included from sessionlist.cpp:21:0: sessionlist.h:24:18: fatal error: pcap.h: No such file or directory compilation terminated. make: *** [all] Error 1

# apt-get install libpcap-dev

another error

root@ubuntu1204-vm1:~/sessionlist# make g++ -march=native -O2 -pipe main.cpp sessionlist.cpp -lpcap -lpthread -lncurses -o sessionlist && strip sessionlist In file included from main.h:25:0,                 from main.cpp:21: sessionlist.h:37:21: fatal error: ncurses.h: No such file or directory compilation terminated. In file included from sessionlist.cpp:21:0: sessionlist.h:37:21: fatal error: ncurses.h: No such file or directory compilation terminated.

install

root@ubuntu1204-vm1:~/sessionlist# sudo apt-get install libncurses5-dev -y

try again

root@ubuntu1204-vm1:~/sessionlist# make g++ -march=native -O2 -pipe main.cpp sessionlist.cpp -lpcap -lpthread -lncurses -o sessionlist && strip sessionlist In file included from sessionlist.h:27:0,                 from main.h:25,                 from main.cpp:21: headers.h:25:2: warning: ‘typedef’ was ignored in this declaration [enabled by default] headers.h:42:2: warning: ‘typedef’ was ignored in this declaration [enabled by default] headers.h:68:1: warning: ‘typedef’ was ignored in this declaration [enabled by default] In file included from main.h:25:0,                 from main.cpp:21: sessionlist.h:76:1: warning: ‘typedef’ was ignored in this declaration [enabled by default] In file included from sessionlist.h:27:0,                 from sessionlist.cpp:21: headers.h:25:2: warning: ‘typedef’ was ignored in this declaration [enabled by default] headers.h:42:2: warning: ‘typedef’ was ignored in this declaration [enabled by default] headers.h:68:1: warning: ‘typedef’ was ignored in this declaration [enabled by default] In file included from sessionlist.cpp:21:0: sessionlist.h:76:1: warning: ‘typedef’ was ignored in this declaration [enabled by default] sessionlist.cpp: In function ‘void displayUsableSessionInfo()’: sessionlist.cpp:394:167: warning: format ‘%i’ expects argument of type ‘int’, but argument 8 has type ‘std::list<unsigned char*>::size_type {aka long unsigned int}’ [-Wformat] sessionlist.cpp:394:167: warning: format ‘%i’ expects argument of type ‘int’, but argument 8 has type ‘std::list<unsigned char*>::size_type {aka long unsigned int}’ [-Wformat] sessionlist.cpp: In function ‘bool hasUsableSessionInfo(std::list<SESSION_INFO>::iterator, char*, char*, char*)’: sessionlist.cpp:439:60: warning: deprecated conversion from string constant to ‘char*’ [-Wwrite-strings] sessionlist.cpp:449:71: warning: deprecated conversion from string constant to ‘char*’ [-Wwrite-strings] sessionlist.cpp: In function ‘void displayUsableSessionInfo()’: sessionlist.cpp:419:27: warning: ignoring return value of ‘int system(const char*)’, declared with attribute warn_unused_result [-Wunused-result] root@ubuntu1204-vm1:~/sessionlist# echo $? 0

root@ubuntu1204-vm1:~/sessionlist# ./sessionlist /* sessionlist v1.0 by rage rage@0xrage.com */ Usage: ./sessionlist [interface] [port]- port is optional and defaults to 80. simple eh?

Seen  from README file , libpcap.so.1 , libncurses.so and libpthread.so are required to compile sessionlist.

Dependencies ------------ libpcap.so.1 libncurses.so.5 libpthread.so.0 So ensure you have these first.

nnn , core dump..

root@ubuntu1204-vm1:~/sessionlist# ./sessionlist eth0 80 /* sessionlist v1.0 by rage rage@0xrage.com */ Illegal instruction (core dumped)

In case of Fedora 18 , libpcap version is 1.3.

root@ubuntu1204-vm1:~/sessionlist# locate libpcap.so /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 /usr/lib/x86_64-linux-gnu/libpcap.so.1.1.1 root@ubuntu1204-vm1:~/sessionlist# locate libncurses.so /lib/x86_64-linux-gnu/libncurses.so.5 /lib/x86_64-linux-gnu/libncurses.so.5.9 root@ubuntu1204-vm1:~/sessionlist# locate libpthread.so /lib/x86_64-linux-gnu/libpthread.so.0