> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/offline-password-cracking.md).
# 离线密码破解
### 离线密码破解
此实验室存储了一个 **将 pass 密码存储在 cookie 中**。此外，评论功能存在一个 **XSS** 漏洞。/ 目的：获取 **carlos** stay-logged-in cookie，破解其离线密码，然后以它的身份登录并删除其账户。
**提供的凭据：**
* wiener : peter/ **受害者：** carlos
### 2. 该 *stay-logged-in* Cookie 的工作原理
勾选“保持登录”时，发送的请求包含：
```bash
username=wiener&password=peter&stay-logged-in=on
```
然后服务器返回一个 **stay-logged-in** cookie 编码为 **Base64**:
解码 →
```bash
d2llbmVyOjUxZGMzMGRkYzQ3M2Q0M2E2MDExZTllYmJhNmNhNzcw
```
* wiener:51dc30ddc473d43a6011e9ebba6ca770
因此使用以下图示：
### 3. 通过 Intruder 进行离线破解尝试
在 Burp 中，你可以使用以下方式创建有效载荷：
1. \*\* MD5 密码转换\*\*
* \*\*带前缀
1. **对整个值进行 Base64 编码**
然后测试字典。
→ 没有明确结果。
### 4. 利用评论中的 XSS
评论字段存在 JavaScript 漏洞：
```javascript
```
因此我们可以通过 fetch 提取 cookie：
```javascript
```
该请求会发送到我们的 exploit-server。
### 5. Carlos 的 Cookie 的恢复和解码
拦截到的 Cookie（Base64）：
```bash
c2VjcmV0PXY2UE5LWnJ3czNYSmFNVWtaU09wOWJRbGRCVUVlQnhLOyBzdGF5LWxvZ2dlZC1pbj1ZMkZ5Ykc5ek9qSTJNekl6WXpFMlpEVm1OR1JoWW1abU0ySmlNVE0yWmpJME5qQmhPVFF6
```
解码 →
* carlos:26323c16d5f4dabff3bb136f2460a943
### 6. 密码破解
将哈希发送到 CrackStation 后，它返回：
### 7. 收尾
与……的连接：
**carlos : onceuponatime**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/offline-password-cracking.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.