1

I am doing some research into scam websites (particularly the ones where you receive a text message telling you you have an undelivered package, or unpaid tolls etc and they provide you with a link to click).

I am using Burp Suite to look at one particular site the victim is sent to. The page itself does not have any content, it simply gives the visitor a session cookie and then redirects to the Google home page. If you unknowingly clicked the link you would presume it was broken, but you secretly end up with this session cookie. There does not appear to be any JS being executed for something like a BeEF hook, only the cookie.

I have looked at cookies before using JSON web token decoders, however the cookie given by this website does not appear to be in the correct format. What is this cookie format?

EDIT:

It appears to be Base64 encoded. I ran it through a Base64 decoder and got the following but I can't make any further sense of it:

{"iv":"vI21osK2mf73wp0a8he8BQ==","value":"AA3WHwNqAG8j1V0SUCZ11JtiDTqBNqulh\/le27u8IlqMA5DtssyM2FGaQqx9wVVK","mac":"5e731b84102b535701551cf61b2dbe997a2e43119b48452665391714495f9201"}7

This is the series of GET requests and responses:

Initial get request for the site

GET / HTTP/1.1
Host: lihi.cc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

Response appears to give the cookie and redirects back to the HTTPS version itself

HTTP/1.1 302 Found
Server: nginx/1.14.0 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, private
Date: Sun, 17 Sep 2023 02:08:30 GMT
Location: https://lihi.cc
Set-Cookie: lihi_session=eyJpdiI6InZJMjFvc0sybWY3M3dwMGE4aGU4QlE9PSIsInZhbHVlIjoiQUEzV0h3TnFBRzhqMVYwU1VDWjExSnRpRFRxQk5xdWxoXC9sZTI3dThJbHFNQTVEdHNzeU0yRkdhUXF4OXdWVksiLCJtYWMiOiI1ZTczMWI4NDEwMmI1MzU3MDE1NTFjZjYxYjJkYmU5OTdhMmU0MzExOWI0ODQ1MjY2NTM5MTcxNDQ5NWY5MjAxIn0%3D; expires=Sun, 17-Sep-2023 02:09:30 GMT; Max-Age=60; path=/; httponly
Via: 1.1 google
Connection: close
Content-Length: 306

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='https://lihi.cc'" />

        <title>Redirecting to https://lihi.cc</title>
    </head>
    <body>
        Redirecting to <a href="https://lihi.cc">https://lihi.cc</a>.
    </body>
</html>

Second GET request based on redirection above

GET / HTTP/1.1
Host: lihi.cc
Cookie: lihi_session=eyJpdiI6InZJMjFvc0sybWY3M3dwMGE4aGU4QlE9PSIsInZhbHVlIjoiQUEzV0h3TnFBRzhqMVYwU1VDWjExSnRpRFRxQk5xdWxoXC9sZTI3dThJbHFNQTVEdHNzeU0yRkdhUXF4OXdWVksiLCJtYWMiOiI1ZTczMWI4NDEwMmI1MzU3MDE1NTFjZjYxYjJkYmU5OTdhMmU0MzExOWI0ODQ1MjY2NTM5MTcxNDQ5NWY5MjAxIn0%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Sec-Ch-Ua: 
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: ""
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

Response to second request redirects to Google

HTTP/2 302 Found
Server: nginx/1.14.0 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, private
Date: Sun, 17 Sep 2023 02:11:43 GMT
Location: https://google.com
Set-Cookie: lihi_session=eyJpdiI6IkRZdDlicHlpK2JCTGdwSzFHaTFvXC93PT0iLCJ2YWx1ZSI6IkxRT3djbTN4YllzQjVWRTJ2RmgxRDdVS1p5eXJNSnlhcnZNRFlhaUdCZlYxYkxGRjk3eDZWMmR3QkdpaysxU2siLCJtYWMiOiJhMTJlMmRmNTI2OTgyN2U3MjdhYjQzZGJmOWE0N2U3ODI5YTZjYjQ4MTg3MjNkY2ViYjI3NGM4NzFmOTYxOGNhIn0%3D; expires=Sun, 17-Sep-2023 02:12:43 GMT; Max-Age=60; path=/; httponly
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='https://google.com'" />

        <title>Redirecting to https://google.com</title>
    </head>
    <body>
        Redirecting to <a href="https://google.com">https://google.com</a>.
    </body>
</html>
Improve this question
1
  • The format looks like the kind of session cookies that Laravel uses.
    – Gh0stFish
    Commented Sep 17, 2023 at 13:04

1 Answer 1

Reset to default
1

The session cookie is base64-encoded JSON, which is apparent by it beginning with ey.... When decoded, it reveals three parameters: IV, value and mac.

IV is a cryptographic term, "initialization vector", and is a small bit of data to be prepended to a ciphertext. It is necessary in some modes of opertion of block ciphers to decrypt the content. In this payload, it's base64-encoded random bytes, as would be expected.

MAC is also a cryptographic term, "message authentication code", and is a sort of "keyed hash", intended to verify a message has not been modified (by someone who does not possess the key). In this case, it's a hash. Nothing else is known.

Value could be anyone's guess. It looks like base64-encoded bytes and might be a ciphertext.

So what do these values mean?

It seems to be some encrypted message. Value is the ciphertext, IV needed for decryption and mac ensures the message is not tampered with - probably because the message was not encrypted with "authenticated encryption".

The purpose is ripe for speculation. It could be part of a Command and Control network, where infected devices contact this host, receive new instructions encrypted, then decrypt and execute them.

Other than that, I don't see any particular use-case for this.

Improve this answer
2
  • Given that it's a "lihi_session" cookie and the host is "lihi.cc", it's probably just tracking the browser identity. There might be some secrets in the ciphertext, but it's short, and could just as easily be a simple ID string, perhaps with some metadata (e.g. the first time it was set, or similar), similar to a JWT. Also, as a side note, authenticated encryption schemes also produce what is effectively a MAC (usually called an "authentication tag"); from the base64-decoded cookie, it's not possible to tell whether this was actually HMACed and encrypted in different steps, or an AEAD cipher.
    – CBHacking
    Commented Sep 17, 2023 at 22:30
  • If they are just tracking the browser identity, to what end? They are not going to go through the time and effort just to see what websites you visit or am I missing a different angle here? I went to the site and then browsed a bit and captured my traffic with Wireshark to analyse if something is "phoning home". I'm not very good with Wireshark so it might take a while.
    – user2334659
    Commented Sep 18, 2023 at 3:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .