Lets discuss this in very simple language, Whenever we login in our account, it generates a unique string that contains the path of automatic login for particular time then after that limited time it expires by itself.
 
Note its life is only up to when your web browser is open. If you close your web browser it will be get deleted(Its latest up gradation in cookie's field for providing more security).
Now this unique string or simply called Magic cookie is stored at two places first copy is stored on server(of which we cannot do anything) and second is stored in our web browser in form of cookie.
This cookie is destroyed by three ways first is when you close your web browser, second is when you sign out of your account and third is if you left your account open for more than 20 minutes idle.



As i am explaining this tutorial for hacking yahoo email account. So in your web browser just open yahoo.com and login into your account.
After that type the below code exactly and then press enter:

javascript:alert(document.cookie);

Now a popup box will appear showing the cookies something like this:
 


Now create one fake account on yahoo.com and login in that account and retrieve the cookie in same manner and notice the changes in session ID's.


For hacking the session cookies we first need the session cookies of the victim and its quite simple to get the session cookies of the victim. You just need to send him one link as soon as he clicks on that we will get his session cookie.

After hacking the session cookies, we can use stolen session cookie to login into victim's account even without providing username and password as i already explained that session hacking removes the authentication on the server as we have the AUTO LOGIN cookie. In this type of attack when victim sign out , then hacker will also sign out. But in case of YAHOO its little bit different, when victim signout but attacker still have the access to his account. Yahoo maintains the session for 24 hours and then destroy the session ID's from its server.



1. Go to the Website and register there:

http://www.my3gb.com/register.jsp

This article is for educational purpose only, We want to make you aware how hacking is done, So don’t misuse this hacking tricks. We are not responsible for any wrong thing done by you

What is brute forcing ?
In layman language, brute forcing means using a tool that picks passwords from a word list and tries them one by one until one works.

How to make a word list ?
A word list can consist of all possible combination's of letter,numbers,special characters. It can have some common or default passwords. You can download the word list generators or goggle the word-lists for brute-forcing and configure them according to yourself.

How fruitful attack can be ?
If we are try all possible combination's of letter,numbers,special characters, theoretically chances of success are 100%. But practically it is not possible to try every combination because it can take a lot of time. This attack just depends on the time you give,processing power and of course your luck.

Many tools are use for it hydra is one of them

Step 1
Download THC Hydra from here

Step 2
(a) Make a usename wordlist consisting of some common usernames like this

(b) Get a wordlist of passwords
(c) Copy both wordlists to your hydra folder

Step 3
(a)Open the command prompt and change directory to your hydra folder using cd command.


(b) Type "hydra" without quotes and it will show you the options to use.

(c) Now to start attak,

Type "hydra -L userslist.txt -P passlist.txt xxx.xxx.xxx.xxx ftp" and press enter

where userslist.txt is the list of usernames, passlist.txt is the list of passwords and xxx.xxx.xxx.xxx is the IP address of target, Now it will start cracking

To use a single username instead of wordlist , Replace capital L with small l , like this

Type "hydra -l username -P passlist.txt xxx.xxx.xxx.xxx ftp"

Note : Ftp port must be open.

Warning: I highly recommend you to use a chain of proxies to spoof your identity because proper logs of user's IP addresses who try to connect to ftp server is made on the server. Here is an example of the same. 

Countermeasures to protect yourself from this attack:
Use strong passwords

Thanks,,,,