> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/offline-password-cracking.md).
# 离线密码破解
离线密码破解，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 离线密码破解
本实验存储了一个 **在 cookie 中存储了一个密码**。此外，评论功能存在一个 **跨站脚本攻击** 漏洞。/ 目的：获取 **carlos** stay-logged-in cookie，破解其离线密码，然后以该用户身份登录并删除其账户。
**提供的凭据：**
* wiener : peter/ **受害者：** carlos
### 2. 该 *stay-logged-in* Cookie 的工作原理
当勾选“保持登录”时，发送的请求包含：
```bash
username=wiener&password=peter&stay-logged-in=on
```
然后服务器返回一个 **stay-logged-in** 以……编码的 cookie **Base64**:
解码 →
```bash
d2llbmVyOjUxZGMzMGRkYzQ3M2Q0M2E2MDExZTllYmJhNmNhNzcw
```
* wiener:51dc30ddc473d43a6011e9ebba6ca770
因此使用如下图：
### 3. 通过 Intruder 进行离线破解尝试
在 Burp 中，你可以使用以下方式创建载荷：
1. \*\* MD5 密码转换\*\*
* \*\*带前缀
1. **对整个值进行 Base64 编码**
然后测试字典。
→ 没有得出明确结果。
### 4. 利用评论中的 XSS
评论字段存在 JavaScript 漏洞：
```javascript
```
因此我们可以通过 fetch 提取 cookie：
```javascript
```
请求会发送到我们的 exploit-server。
### 5. 恢复并解码 Carlos 的 Cookie
拦截到的 Cookie（Base64）：
```bash
c2VjcmV0PXY2UE5LWnJ3czNYSmFNVWtaU09wOWJRbGRCVUVlQnhLOyBzdGF5LWxvZ2dlZC1pbj1ZMkZ5Ykc5ek9qSTJNekl6WXpFMlpEVm1OR1JoWW1abU0ySmlNVE0yWmpJME5qQmhPVFF6
```
解码 →
* carlos:26323c16d5f4dabff3bb136f2460a943
### 6. 密码破解
将哈希发送到 CrackStation 后，它返回：
### 7. 完成
连接到：
**carlos : onceuponatime**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/offline-password-cracking.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
