0

I am getting confused by a website cookie authentication process. I captured the packets going from the website and saw the cookie being sent. I copied the entire cookie content of the website and created the same cookie on a different machine and loaded the website but I was not able to login.

How is the server identifying me? I did not see anything important sent in packet capture.

  • The two computers share the same public IP address? – Jeroen Jan 26 '17 at 11:49
  • no they are having different ip – Jeevansai Jinne Jan 26 '17 at 11:59
  • In that case the session ID might be bound to the public IP. – Jeroen Jan 26 '17 at 12:22
  • i tried spoofing ip but not working – Jeevansai Jinne Jan 26 '17 at 12:38
5

The site is probably protecting against session hijacking by using some kind of heuristic to guess that you are not the same user, e.g.:

  • IP
  • Geolocation (of IP)
  • User agent

All of these are imperfect in the sense that they can be bypassed. Some may also filter out legitimate users. Without knowing how the server is configured you can only guess and ivestigate with trial and error. Try sending the exact same HTTP request from a machine with the same external IP and see what happends.

Other ossibilities is that you picked the wrong cookie, missed some other security feature that needs to be included (e.g. CSRF headers), or that the session simply timed out.

| improve this answer | |
  • i tried sending same http request from machine with same ip still i was not able to login and both the machines are at same location and same browser and there is only single cookie stored – Jeevansai Jinne Jan 26 '17 at 12:12
  • Have you captured the two requests, to make sure that they match each other, letter by letter? If they do match, there is something more going on, but with out being able to poke around it is impossible for me to say what it is. – Anders Jan 26 '17 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.