John is monitoring his local area network. He knows that a new token based authentication system has been implemented for user authentication. He is no longer able to gather clear text password as…

John is monitoring his local area network. He knows that a new token based authentication system has been implemented for user authentication. He is no longer able to gather clear text password as he used to and this prevents him from abusing and using other users accounts. How can John take advantage of an already established and authenticated session? What technique would he use to do so?