How to log into Facebook using an active session cookie in the DOM?

Question

I’m studying security in web applications.

For educational purposes, I logged on to my Facebook page and copied my active session cookie obtained on document.cookie, then I opened another browser, entered the main page of facebook (dislocated) and declared document.cookie = my active session cookie in the other string browser.

It didn’t work. So I downloaded an extension to Inject Cookie manually. I copied and put all the cookies of my active session in the extension in the other browser and also did not work.

My logic was simple: With a valid active session ID being declared on document.cookie the server should take me inside the user page while giving refresh.

My question is: at what point is my logic wrong and why?

Answer 1

To make it work you need to use a Valid User-Agent[Browser] header, this one has to be up to date, so you can use the live http headers[~Chrome] extension to get the order data. I’ve made several requests on Facebook, only 2 cookies validate the session[The C_USER and the XS], You can use all[Time, Referer, etc]. to enter the user’s account or not. In addition, the request must be made through the SSL port[443].

EX REQUEST:

GET / HTTP/1.1
Host: www.facebook.com:443
Cookie: c_user=4; xs=44%código+time; csm=2;
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36

It’s basically this to get on Facebook, Facebook uses the other Cookies to monitor your activity and log in on visited pages, Just like the Referer fields, And the visiting time.

I hope I’ve helped you and been helpful in that answer, good luck!

Answer 2

Strange to ask, because it was well what I just did earlier this morning, basically just fill in the variables see which are with the debug as picture below:

After that just load the cookies with the values follows an example:

function setCookie(cname,cvalue,exdays){
            var d = new Date();
            d.setTime(d.getTime()+(exdays*24*60*60*1000));
            var expires = "expires="+d.toGMTString();
            document.cookie = cname+"="+cvalue+"; "+expires;
        }

setCookie('c_user',1234567890);