> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/brute-forcing-a-stay-logged-in-cookie.md).
# 对持久会话 Cookie 进行暴力破解
### 暴力破解保持登录 Cookie
本实验允许用户在关闭浏览器后仍保持连接。用于此功能的 cookie 可被暴力破解。/ 要完成实验，您需要暴力破解 Carlos 的 cookie 以访问其“我的账户”页面。
**提供的凭据：** `wiener:peter`/ \*\* 受害者姓名：\*\* `carlos`
### \*\*机制分析
当你勾选自动重新连接选项时，会发送以下请求：
```bash
username=wiener&password=peter&stay-logged-in=on
```
然后服务器返回一个名为 **stay-logged-in**，其内容采用 Base64 编码：
```bash
d2llbmVyOjUxZGMzMGRkYzQ3M2Q0M2E2MDExZTllYmJhNmNhNzcw
```
解码后，我们得到：
```bash
wiener:51dc30ddc473d43a6011e9ebba6ca770
```
因此，cookie 结构为：
通过在 CrackStation 上检查该哈希，我们发现它对应于值 **peter** 使用 MD5。
### **暴力破解设置**
1. 将 cookie 请求发送到 **Burp Intruder** 并选择 cookie 值作为注入区域。
在 Payload Processing 中：
* 添加一个生成哈希的转换 **MD5**;
* 添加前缀： `carlos:`
* 全部编码为 **Base64**.
1. 在有效载荷设置中加载密码列表。
在攻击过程中，一个响应 **200** 表明 Carlos 的正确 cookie。
获得的 cookie 为：
```bash
Y2FybG9zOjdkOGJjNWYxYThkMzc4N2QwNmVmMTFjOTdkNDY1NWRm
```
解码
{% code overflow="wrap" %}
```bash
echo -n "Y2FybG9zOjdkOGJjNWYxYThkMzc4N2QwNmVmMTFjOTdkNDY1NWRm" | base64 -d ;echo
```
{% endcode %}
* carlos:7d8bc5f1a8d3787d06ef11c97d4655df
通过在 CrackStation 上检查此哈希，我们发现其对应的密码是 **taylor**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/brute-forcing-a-stay-logged-in-cookie.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.