Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get:

[fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, neither datr, nor lu, etc. at some offset of the file, there are these strings. Could they be the active Facebook session that was open at the last use of the cell phone? How do I know the length of the fields in order to inject the cookies in a web browser and hijack the session?

[webview.db] This database does contain a table cookies and some records in it, that are: "datr" and "lu". I tried to inject these two cookies in my web browser but couldn't get logged into my account.

I'm planning to dump all records in a format that can be imported into Firefox's Cookie Manager and see if that works.

The main question would be: Is it possible to use that information the same way one could capture live traffic and extract and then inject cookies sent within the LAN to Facebook servers? If so, what cookies or information I'm missing?

share|improve this question
    
I'm using my own cellphone, thus I'm sure that the facebook application has my account open and running on android, at the moment of the databases dump. I know any needed cookie or account info is there. –  Martin0x777 Nov 13 '13 at 3:40
    
Are you sure that none of the needed information is stored in memory? I wouldn't expect everything to be in the local db. One thing that might make this easier is if you have a rooted phone to just download a sqlite browser/editor and you can edit/view the fields directly –  KDEx Nov 13 '13 at 4:09
    
In memory card? I'm using both an hex editor and a sqlite browser and that's why I know that even when no records exists with, for example, the string "c_user", the string is indeed in the file. In a live traffic capture I get another cookies that are not in here, such as "fr". –  Martin0x777 Nov 13 '13 at 12:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.