> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/brute-forcing-a-stay-logged-in-cookie.md).
# 暴力破解持久会话 Cookie
暴力破解持久会话 Cookie，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 暴力破解保持登录的 Cookie
这个实验允许用户在关闭浏览器后仍保持连接。用于此功能的 cookie 容易受到暴力破解。/ 要完成此实验，你需要暴力破解 Carlos 的 cookie，以访问其“我的账户”页面。
**提供的凭据：** `wiener:peter`/ \*\* 受害者姓名：\*\* `carlos`
### \*\*机制分析
当你勾选自动重新连接选项时，会发送以下请求：
```bash
username=wiener&password=peter&stay-logged-in=on
```
服务器随后返回一个名为 **stay-logged-in**的 cookie，其内容经过 Base64 编码：
```bash
d2llbmVyOjUxZGMzMGRkYzQ3M2Q0M2E2MDExZTllYmJhNmNhNzcw
```
解码后，我们得到：
```bash
wiener:51dc30ddc473d43a6011e9ebba6ca770
```
因此，cookie 结构为：
通过在 CrackStation 上检查该哈希，我们发现它对应于值 **peter** 的 MD5。
### **暴力破解设置**
1. 将 cookie 请求发送到 **Burp Intruder** 并将 cookie 值选择为注入区域。
在有效载荷处理：
* 添加一个生成哈希的转换 **MD5**;
* 添加前缀： `carlos:`
* 全部编码为 **Base64**.
1. 在有效载荷设置中加载密码列表。
在攻击过程中，一个响应 **200** 表示 Carlos 的正确 cookie。
获取到的 cookie 是：
```bash
Y2FybG9zOjdkOGJjNWYxYThkMzc4N2QwNmVmMTFjOTdkNDY1NWRm
```
解码
{% code overflow="wrap" %}
```bash
echo -n "Y2FybG9zOjdkOGJjNWYxYThkMzc4N2QwNmVmMTFjOTdkNDY1NWRm" | base64 -d ;echo
```
{% endcode %}
* carlos:7d8bc5f1a8d3787d06ef11c97d4655df
在 CrackStation 上检查此哈希后，我们发现对应的密码是 **taylor**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/brute-forcing-a-stay-logged-in-cookie.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
