I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy person quickly) can attacker by man-in-the-middle-attack send me a facebook page in http and see my cookie then use that cookie to use my account?
Not speaking for Facebook specifically, but in any decently configured Web server, the cookies sent over HTTPS are marked "secure" and the browser will not send them back to the server if not using HTTPS (from the browser point of view, if the name is the same but not the protocol, then it is not the same server).
Of course, a user who crazily clicks without paying attention... that's the root of all vulnerabilities.
|show 2 more comments|
No, this is not possible because Facebook uses HTTPS for everything. You can MITM Security.StackExchange.com and StackoverFlow.com and no one cares.
Other than an OWASP a9 violation, there are plenty of other vulnerablites that allow you to access a victom's account. XSS, CSRF, Insecure Direct Object Reference, SQL Injection... The list goes on.