Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get:

If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, neither datr, nor lu, etc. at some offset of the file, there are these strings. Could they be the active Facebook session that was open at the last use of the cell phone? How do I know the length of the fields in order to inject the cookies in a web browser and hijack the session?

This database does contain a table cookies and some records in it, that are: datr and lu. I tried to inject these two cookies in my web browser but couldn't get logged into my account.

I'm planning to dump all records in a format that can be imported into Firefox's Cookie Manager and see if that works.

The main question would be: Is it possible to use that information the same way one could capture live traffic and extract and then inject cookies sent within the LAN to Facebook servers? If so, what cookies or information I'm missing?

share|improve this question
I'm using my own cellphone, thus I'm sure that the facebook application has my account open and running on android, at the moment of the databases dump. I know any needed cookie or account info is there. – Martin0x777 Nov 13 '13 at 3:40
Are you sure that none of the needed information is stored in memory? I wouldn't expect everything to be in the local db. One thing that might make this easier is if you have a rooted phone to just download a sqlite browser/editor and you can edit/view the fields directly – Morgoroth Nov 13 '13 at 4:09
In memory card? I'm using both an hex editor and a sqlite browser and that's why I know that even when no records exists with, for example, the string "c_user", the string is indeed in the file. In a live traffic capture I get another cookies that are not in here, such as "fr". – Martin0x777 Nov 13 '13 at 12:33
Hex editor? That's a bit hard-core for me - I'd have used something like – symcbean Mar 18 at 20:50

Any 'active' login cookie is only valid for that session (see how SSL works).

Your method/concept of extracting an 'active' cookie from the phone and inserting into another session is technically possible but for it to actually work you need to first have a truly active cookie.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.