How to log into Facebook using an active session cookie in the DOM?

Asked

Viewed 2,173 times

4

I’m studying security in web applications.

For educational purposes, I logged on to my Facebook page and copied my active session cookie obtained on document.cookie, then I opened another browser, entered the main page of facebook (dislocated) and declared document.cookie = my active session cookie in the other string browser.

It didn’t work. So I downloaded an extension to Inject Cookie manually. I copied and put all the cookies of my active session in the extension in the other browser and also did not work.

My logic was simple: With a valid active session ID being declared on document.cookie the server should take me inside the user page while giving refresh.

My question is: at what point is my logic wrong and why?

  • no one........?

  • Maybe facebook uses browser data to sign cookies. I have already done this myself.

2 answers

2


To make it work you need to use a Valid User-Agent[Browser] header, this one has to be up to date, so you can use the live http headers[~Chrome] extension to get the order data. I’ve made several requests on Facebook, only 2 cookies validate the session[The C_USER and the XS], You can use all[Time, Referer, etc]. to enter the user’s account or not. In addition, the request must be made through the SSL port[443].

EX REQUEST:

GET / HTTP/1.1
Host: www.facebook.com:443
Cookie: c_user=4; xs=44%código+time; csm=2;
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36

It’s basically this to get on Facebook, Facebook uses the other Cookies to monitor your activity and log in on visited pages, Just like the Referer fields, And the visiting time.

I hope I’ve helped you and been helpful in that answer, good luck!

  • Okay, I know the cookies, but how do I request 443 and then using these cookies?

  • Hello ropbla9, You can use network test tools to run the request, Server side programming languages like PHP, Python or Ruby, Or else extensions using the functions of Google Chrome, Like the "Request Maker", Already pro Mozilla, You can use the extension HTTP Request Maker.

1

Strange to ask, because it was well what I just did earlier this morning, basically just fill in the variables see which are with the debug as picture below: inserir a descrição da imagem aqui

After that just load the cookies with the values follows an example:

function setCookie(cname,cvalue,exdays){
            var d = new Date();
            d.setTime(d.getTime()+(exdays*24*60*60*1000));
            var expires = "expires="+d.toGMTString();
            document.cookie = cname+"="+cvalue+"; "+expires;
        }

setCookie('c_user',1234567890);

Browser other questions tagged

You are not signed in. Login or sign up in order to post.