4

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get:

fb.db
If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, neither datr, nor lu, etc. at some offset of the file, there are these strings. Could they be the active Facebook session that was open at the last use of the cell phone? How do I know the length of the fields in order to inject the cookies in a web browser and hijack the session?

webview.db
This database does contain a table cookies and some records in it, that are: datr and lu. I tried to inject these two cookies in my web browser but couldn't get logged into my account.

I'm planning to dump all records in a format that can be imported into Firefox's Cookie Manager and see if that works.

The main question would be: Is it possible to use that information the same way one could capture live traffic and extract and then inject cookies sent within the LAN to Facebook servers? If so, what cookies or information I'm missing?

5
  • I'm using my own cellphone, thus I'm sure that the facebook application has my account open and running on android, at the moment of the databases dump. I know any needed cookie or account info is there. Nov 13, 2013 at 3:40
  • 1
    Are you sure that none of the needed information is stored in memory? I wouldn't expect everything to be in the local db. One thing that might make this easier is if you have a rooted phone to just download a sqlite browser/editor and you can edit/view the fields directly
    – KDEx
    Nov 13, 2013 at 4:09
  • In memory card? I'm using both an hex editor and a sqlite browser and that's why I know that even when no records exists with, for example, the string "c_user", the string is indeed in the file. In a live traffic capture I get another cookies that are not in here, such as "fr". Nov 13, 2013 at 12:33
  • 1
    Hex editor? That's a bit hard-core for me - I'd have used something like sqlitebrowser.org
    – symcbean
    Mar 18, 2016 at 20:50
  • @Martin0x777: Forget the hex editor. There are a lot of reasons why sqlite databases contain strings that you can't see when you query the database, but none of them are relevant for you. Data you can't see in a normal database query is no longer part of the database, even if it's still in the file itself, and if it's no longer part of the database, obviously it's no longer information that either the FB client or the FB server consider valid. Feb 12, 2017 at 16:28

1 Answer 1

1

Any 'active' login cookie is only valid for that session (see how SSL works).

Your method/concept of extracting an 'active' cookie from the phone and inserting into another session is technically possible but for it to actually work you need to first have a truly active cookie.

1
  • I don't get it. The second paragraph of your answer makes sense, but what does a cookie have to do with SSL, or the SSL link you provided? Feb 12, 2017 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .