Why Sniff Session Cookies when UN/PW should also be available?

Question

I've recently been reading on session cookies and how they can be hijacked via man-in-middle attacks. It seems this is mainly possible on an unencrypted connection between a client and a webserver.

However, I cannot figure out why, if one is already 'in the middle' of an unencrypted connection, would one prefer to capture the cookie instead of the username & password which should also be sent in plaintext?

Answer 1

There are 2 main reasons why cookies are easier to steal than login credentials:

Cookies are sent for every request, login credentials are only sent once for each "session"

If you sniff a network, it is less likely that you will be in place at the point when a user actually perform a login using its username and password.

Cookies on the other hand, are sent for each request to the web server. It is just more likely that you will be able to capture a session cookie than a username/password autentication.

It is hard to predict which GET/POST parameters that contains login credentials

Sniffing the actual authentication credentials on the web can be a bit tricky. This is because virtually every web application have its own way of doing it. It is hard to anticipate all the various authentication URL's.

For example:

GET /login?username=dogeatcatworld&password=letmein
GET /auth?u=dogeatcatworld&p=letmein
GET /auth?auth=<base64encoded credentials>

Cookies on the othe hand, always exist in the HTTP header, and it is trivial to extract these from the requests.

Answer 2

If the username and password were sent in plaintext, then yes, sniffing them is a better option.

However, a common pattern is for the login process to be encrypted (for security), and then the remainder of the session takes place in the clear (because encryption imposes a bit of a performance penalty). In such a case, the username and password cannot be captured, but the session cookie, which is being passed around in the clear, can.