Engadget reported on a free “research” Android app tool that can intercept web session profiles of computers on a WiFi network.
An Android phone needs to be rooted (the Android equivalent of iPhone jailbreaking) in order to use the app. Once installed the app can hijack up to three profiles. A paid unlock code allows it to do more. It is not able to hijack a web session using SSL. However, determining when SSL is used is an interesting question. For example, as of seven months ago, the Facebook for iPhone app used SSL for the login proces but left session cookies unecrypted.
You can find more information about FaceNiff at: