How to solve this question using burpsuite? [web proxies - zap fuzzer]

The directory we found above sets the cookie to the md5 hash of the username, as we can see the md5 cookie in the request for the (guest) user. Visit ‘/skills/’ to get a request with a cookie, then try to use ZAP Fuzzer to fuzz the cookie for different md5 hashed usernames to get the flag. Use the “top-usernames-shortlist.txt” wordlist from Seclists.

i got the username list i added the payload processing rules to convert the list to md5 hases but where should i put the pointer? there is no set cookies header please help how to enumurate?


Hi there. Hope everything is fine with you.

First of all, didn’t you found the cookie in the header of the request? It should be there. In my case, it was the first thing i looked for and it took me just a refresh on the page to appear a cookie field in header. Try that and if it doesn’t work, paste the request header here so we can take a look.

1 Like

no i didnt find any set cookie headers on request otherwise i would have done that, i got the set cookie header on response so thats why i dont know know how to fuzz it

like I told you, paste the request here. without that, no one will be able to help you

1 Like