I’m stucking “Bruteforcing Cookies” section at 1-st question.
I intercepted and decoded the cookies. Then I set up an attack in burp intruder (screenshot).
For bruteforce, I generated a unix timestamp within ± 10 minutes from the intercepted cookie.
I changed the prefix. I’ve tried different usermane (htbuser, htbadmin, empty value), different role (admin, super user, superuser, sudo, su, empty value). But always the server response is no different.
Could someone give a hint in which direction to move to solve this question
I’m stucking “Bruteforcing Cookies” section too.
I cant get a flag for htbadmin trying different super user’s roles like root, sudo, su, superuser, superuser, admin, administrator using a python script from the section and filtering “HTB” flag string in responds and brutforcing the last 5 numbers of the timepstamp. I believe, cookie encoding flow is correctly as it has the same format as a cookie for user:htbuser with the role:student and I can see discovering name and role in responses.
just fuzzing the roles is enough or should fuzz the timestamp as you did?
Tried many different roles: admin, superuser, root, professor, dean, but nothing gave me the flag
If you haven’t found the right value yet, then I’ll tell you that the timestamp is not important. Focus on the role, it’s something related to “super user”
Probably wordlists containing “superuser” (or similar). If your wordlist doesn’t still work, you should double-check your code. Perhaps you miss a step in your encoding process or you have a bug.
Watch out for newline (“\n”) in some wordlists, this will corrupt your payload.
Try to analyze your requests/responses using a proxy, wireshark, tcpdump,…
Yeah I can’t find anything wrong with the cookies or encoding I’m using. When I brute force I output the cookie I develop to the screen and use a user and role that I KNOW will work…it’s one of the support users that I have got the password for. So I log in and copy the encoded cookie from the browser. Then I run my script to output the cookie I build for the same user and role - the browser cookie for that user and role and my coded cookie are identical, so I know my script works correctly. I just don’t seem to be able to find a working role.
Have you checked that there is no newline in your wordlist? Encoding with “\n” leads to different results… The server doesn’t strip the input…
That was one of my big issues (Thanks to burpsuite, I could find and fix it).
Hello,
I try with role “root, sudo, su, superuser, admin, administrator, htbadmin and super user”.
With lot of user: htbuser, htbadmin, user, superuser
Nothing work, can you help me pls?
Thx,
I am in need of some help here as well… I have two questions. First is how do I automate testing the cookies with the different levels of encoding needed? Do I need to modify the python script and if so can someone help me as to how? I can do it manually using burp decoder or cyberchef but I am sure there is a way to automate it… Second question is what list should I be using? I tried all the superuser combinations listed in CommonAdminBase64.txt but nothing seems to be giving me a flag… Thanks!
There are clues to the format of the usernames in that section. I scripted mine. I think there is a script in the materials they named something like automate_cookie_tampering.py. I modified a version of that to get it to work.
Ok I was on the right track then, hopefully. I was playing with that but only was encoding the “role” part of the payload. I couldn’t figure out how to encode the rest of the payload that I was not changing. So If I set multiple payload positions, use pitchfork attack and just have the data stay static everywhere aside from the role (which I would use the word-list on) maybe that would work? I am going to give it a try. I did read that section on predictable usernames a couple times now, I’ll give it a fresh look and see if I can figure out what word-list to use. I would love to learn how to script it as well but I will try burp first. Thanks for the help!
