Hacking Cookies

Using Burp to Hack Cookies and Manipulate Sessions


In the first place, guarantee that Burp is accurately arranged with your browser.With catch killed in the Proxy "Block" tab, visit the login page of the application you are trying in your program.



Sign in to the application you are testing.You can sign in utilizing the qualifications user:user.


Come back to Burp.In the Proxy "Catch" tab, guarantee "Block is on".
Refresh the page in your browser.The request will be captured by Burp, it can be viewed in the Proxy "Intercept" tab.Cookies can be viewed in the cookie header.


We now need to investigate and edit each individual cookie.Right click anywhere on the request and click "Send to Repeater".Note: You can also send requests to Repeater via the context menu in any location where HTTP requests are shown, such as the site map or Proxy history.


Go to the Repeater tab.The cookies in the request can be edited easily in the "Params" tab.


By removing cookies from the request we can ascertain the function of each cookie.In this example, if the "username", "uid" and "PHPSESSID" cookies are removed, the session is ended and the user is logged out of the application.We can use the Repeater to remove cookies and test the response from the server.Remove and add cookies using the "Add" and "Remove" buttons and use the "Go" button to forward requests to the server.


Cookies can be edited in the Request "Params" table.In this example we have altered the value of the "uid" cookie to 1.Alter the value then click the "Go" button.

The response from the server can be viewed in the "Response" panel in Repeater.The response shows that by altering the "uid" cookie we have logged in to the application as "admin".We have used cookies to manipulate the session and access another account with elevated privileges.



Comments

Post a Comment

Popular posts from this blog

The Secure Socket Tunneling Protocol

Image
The Secure Socket Tunneling Protocol This segment depends on a prerelease adaptation of Windows Server 2008. All data in this is liable to change. Virtual private system (VPN) bolster in Windows XP and Windows Server 2003 enables you to interface with your private intranet over the Internet, similarly as though your PC was connected to a neighborhood Ethernet port. Nonetheless, the VPN conventions in Windows XP and Windows Server 2003 don't work for some firewall arrangements what's more, for some circuitous arrangements, for example, when your PC is behind a Network Address Translator (NAT) or Web intermediary server—in which the movement for VPN associations is being blocked. To determine these challenges, Windows Server® 2008 and Windows Vista Service Pack 1 incorporate help for the new Secure Socket Tunneling Protocol (SSTP). VPN Access Problems In Windows® XP and Windows Server 2003, the VPN conventions that empower remote access associations with an intranet
Read more

Fake WAP

Image
Fake WAP There are a horde of things out there that goes under the general name 'hacking.' But what precisely are these demonstrations and what is the completely most effortless one for programmers to finish? This is a stealth assault, similar to a lethal ninja, known as a phony remote access point (Fake WAP). You may likewise know it as a 'man in the center' assault. Programmers can do this effectively enough, taking your information covertly with the goal that you're unaware. More regrettable yet, you'll HELP them do it! A VPN is your vital component to ensuring this doesn't transpire, regardless of the possibility that you do fall into their trap. As a reward, I get the chance to add pictures of ninjas to this post and it absolutely bodes well. What is a fake wireless access point This is the point at which a programmer utilizes a basic bit of programming and a remote system get to card. They will utilize these and go out into the general
Read more

Lets Make a Simple Keylogger

Image
Make Simple Keylogger Using Python This is a basic keylogger that can made utilizing python. I attempted to make one in cluster or vbs, yet it is basically unthinkable. So I needed to utilize python.  All of you see on the web, keyloggers, a then you download it and introduce it to spy or screen somebody (Windows 10 even has a worked in keylogger) . In any case, the issue is, is that you presumably likewise introduced a huge amount of infection of other garbage simultaneously.  I will demonstrate to you industry standards to make your own, or you can download mine beneath: (in the event that you are uncertain about downloading, I'll send you evidence that it isn't malignant) Step 1 : Installing Python Step 2 : Creating the code When you have the greater part of the python stuff introduced, open up sit still and make another content. At that point enter in the accompanying code: Then save it as something.pyw Step 3 : Test Presently dou
Read more