PHP has some nice, neat builtins for dealing with sessions: there'ssession_start() and session_id() and session_destroy() functions, which work with a superglobal variable, $_SESSION, to store name/value pairs. What more could a programmer want?

As near as I can tell, the default PHP behavior is to keep the contents of sessions in files, on Linux, under /tmp/, but it looks like this can be changed in php.ini. Are the contents of these session files ever used forensically, to figure out what's gone on?

  • Note that "oRb" changed their webshell to use cookies, rather than PHP sessions, between v2.4 and 2.5 of the famed WSO/FilesMan web shell. I was wondering what motivated oRb to do that. – Bruce Ediger Aug 4 '18 at 15:05

Whether or not the PHP session had any forensically useful data in it really depends on what kind of information that the application stores in the session. So yes, if applications store forensically useful information in the session (which is quite common) then the session files will have useful data in it.


I could see advantages for mass surveillance intercepting PHP sessions to track that individual user's exact movements. Although, I would see more advantage to using the web browser's cookie(s) for targeted surveillance.

This said I could foresee using PHP session data to reverse engineer how the php.ini file in configured. Working from there, the better I understand php.ini configuration the closer I am to finding a vulnerability with the PHP server. PHP: Sessions - Manual. PHP Garbage collector.

Are the contents of these session files ever used forensically

I have not seen scenarios for digital forensics of PHP sessions. However, each session has a unique ID which could be used to perform targeted surveillance of an individual. However, this will only work if enough logs are stored for the session ID to be matched with the session data, and ordinarily, servers do not handle full take (metadata and content) interception. Despite not directly answering your question Command-Line Forensics of hacked PHP.net may give some insight.

Cookie Examiner forensics analysis. This should outline the type of metadata we expect for performing forensic data analysis.

  • Thanks for the references. Good stuff. I couldn't find anything on PHP session files forensics using Google or Duck Duck Go. Probably one of those "too many common words" cases. – Bruce Ediger Aug 4 '18 at 16:52
  • 1
    Obviously, keep looking, but requiring specific words in my searches did not return anything directly relevant. Hence, why my answer consists of opinion and deductions. I have experienced this with a question I asked before, where the required answer was so specific, such that it had not been directly searched previously or answered before. Despite the hours it took me, I was able to answer my own question, but it required reviewing how the program worked. This might be your scenario, unfortunately. – safesploit Aug 4 '18 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.