0

Client POSTs creds, and if authenticated, server responds with a 302 redirect to an enormous path:

https://phpwebsite.com/login/auth/[encoded_data]

where encoded_data is either 811, or 726 characters long (for admins and unprivileged users respectively).

charset is [a-zA-z0-9_-] and looks like underscore/hyphen are being used to encode data rather than as separators. here are the first 80 characters from four authenticated requests:

kDXQCdyBLGeI6iffL7NCerz-2n7cqsQkAd--qu_cwaDku3u05mkOfLnhG0X0jhYj78VCulnaWX96Aaj3
O_sTfG87ndgFssFpZrQ1zIi7AXGs8ft-ufiRcs9tec0seoMnZuuvYexCmRONdhylx5mxy_QJw8qD04CM
hY1YSR-1yT6Mr61HPd0sKHRsGpIHvfXCyvTreOza9hMMmROxv9RKdDY-4gb1z4IMAlGM0aaFqaCUv1VN
qtFUBJtBT-6eL7Fxrj47H2ryTVe0uVLWHVxtxC-Xp0Hw2g-7gN_ovBi-e_i-iTHDAmbhNJkesk_7wxSI

Client GETs the massive path string and server responds with a new, PHPSESSID cookie value for the authenticated session. I realise length, and the /login/auth/ component of the path could be variable (user-set), but I don't know how it has been configured.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.