How to Install Firesheep on Linux

How to install Firesheep from source code
By FuegoFro

Here is my tutorial for installing Firesheep on Ubuntu 10.10. This assumes you have no experience working with source code, but you should be comfortable working with the terminal. I have tested it with a fresh install on my laptop running Ubuntu 10.10 64-bit. According to michajlo, the code should still compile properly on 32-bit systems. If you are unable to see any logins, you should test whether your wireless card is compatible using Wireshark. See the end of the tutorial for instructions on how to do that.

1. You first need to get all the libraries necessary to compile code and fulfill the dependencies for Firesheep. To do this, go into the terminal (<ctrl>+<alt>+t or Applications -> Accessories -> Terminal) and paste the following command:

sudo apt-get install build-essential autotools-dev automake autoconf git xulrunner-1.9.2-dev libpcap-dev libboost-dev aircrack-ng

2. Next, we need to create or modify a folder to hold our source code. This is usually in /usr/local/src. Before we can use that, we need to change its permissions:

sudo chown $USER /usr/local/src
sudo chmod u+rwx /usr/local/src

NOTE: Throughout this tutorial, I assume that your code is in /usr/local/src. If you want to put your code somewhere else, every time you see /usr/local/src, replace it with your chosen folder.

3. Now, we grab the source code from the website:

cd /usr/local/src
git clone http://github.com/michajlo/firesheep.git
cd firesheep
git submodule update --init

4. Now its time to actually compile the code. To do this, type:

./autogen.sh --with-xulrunner-sdk=/usr/lib/xulrunner-devel-1.9.2.12
make CPATH=/usr/include/nspr

5. Now we need to install the plugin in Firefox. The following command should do it:

firefox build/firesheep.xpi

Click the "Install Now" button in Firefox when it becomes available after the built-in delay. You'll then have to restart Firefox.

6. After restarting Firefox, quit it. NOTE: You must fully restart Firefox to complete the installation of the plug-in. The last setup step is to fix the permission of the backend.

cd ~/.mozilla/firefox/*.default/extensions/firesheep@codebutler.com/platform/*gcc3
sudo ./firesheep-backend --fix-permissions

7. Now, the installation has been completed, but there is one last thing you will have to do each time you want to run Firesheep. This is to create another, virtual network interface that channels the data from your wireless so that you can capture data from other people. To do this, you will have to find two pieces of information about your wireless connection. First, make sure you are connected to the network you want to sniff. Then, in terminal, type:

iwconfig

The information we are looking for is the name of the wireless interface. This will usually be wlanX where X is a number. For instance, my interface is wlan0. The next piece of information is the MAC Address of the Access Point you are connected to. This should be on the same line as the interface name. For instance, if the whole output is:

/*other interfaces*/

wlan1     IEEE 802.11bgn  ESSID:"Network Name"
          Mode:Managed  Frequency:2.412 GHz  Access Point: 00:11:22:33:44:55
          Bit Rate=54 Mb/s   Tx-Power=20 dBm
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Power Management:on
          Link Quality=66/70  Signal level=-44 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

/*other interfaces*/

Then the interface would be wlan1 and the MAC Address would be 00:11:22:33:44:55. You will also need the IP Address and Subnet Mask given to you by the Access Point. On Ubuntu, you can find this by right-clicking on the networking widget and clicking "Connection Information" Make sure you have this information available for the next step. In the terminal, type:

sudo airmon-ng start [INTERFACE]

where [INTERFACE] is the interface name found above.

sudo airtun-ng -a [MAC_ARRD] mon0 &

where [MAC_ADDR] is the MAC Address of the Access Point found above.

sudo ifconfig at0 [IP_ADDR] netmask [SUBNET_MASK] up

I think you get the idea, but where [IP_ADDR] and [SUBNET_MASK] are the IP Address and Subnet Mask found above, respectively.

Note: On that last step (ifconfig) at0 might be different (at1, for example). The value for that can be found in the output from the airtun-ng command. It will say something like: "created tap interface at0". This will only be a problem if you repeat the commands in this step multiple times without restarting.

At this point, it should be basically working. If you fire up Firefox and open up the Firesheep sidebar (<ctrl>+<shift>+s), click the gear -> preferences, and choose atX (eg. at0), hit Start Capturing, and enjoy. Next time you start your computer, you will have to repeat step 7.

TO RECAP:
Here are the condensed steps to run Firesheep after startup:

sudo airmon-ng start [INTERFACE]
sudo airtun-ng -a [MAC_ADDR] mon0 &
sudo ifconfig atX [IP_ADDR] netmask [SUBNET_MASK] up
**choose the atX interface from Firesheep**

Enjoy!

IF YOU CAN'T SEE ANYTHING:
If you don't get any captures and you know people are logging onto the supported websites using insecure connections, use wireshark to test if your wireless card is supported:

sudo apt-get install wireshark
sudo wireshark

Disregard the warning message for now, click on your wireless interface in the "Interface List" in the upper left. (eg. wlan0, not at0) A new window should appear and if you are connected to a wireless network, should immediately start filling with data. However, if you are using the network and nothing shows up or your interface isn't listed at all, then your wireless card isn't supported and you can't run Firesheep. I'm sorry.