Waraxe IT Security Portal

na85 · Regular user

Hi all, I'm na85, and I'm new but hoping to learn some skills soon Smile

I recently tried to log in to a phpbb site (recent version, 2.0.19) as another user via the cookie method. After being urldecoded, the cookie looks something like this: 86862982519b45b5b817140.25368421

The string is the right length but obviously md5 hashes can't have .'s in them. I then read somewhere here that you can't get a password hash from the forum's cookie in the later versions. If this is the case, how do the new sites authenticate users? I am currently looking through ethereal output of me logging in to my own site, trying to find a password hash. No dice so far.

Either way, I was going to submit this user's hash to plaintext but they seem to be down. Are there any brute-forcing tools that will crack 8-character passwords that contain upper- and lower-alpha, numeric, and symbols? I was using MDcrack but its charset limit is too small.

thanks for the help
na85

Chb · Valuable expert

As far as I know is this value like a session id, which will be compared with the value in the database, if I am right.

na85 · Regular user

I believe it's the result of a uniqid() function that combines a user's last IP, last login and SID.

If someone could gather that information, would it be possible to generate the same cookie?

mainstream · Regular user

post the whole cookie xx the domain