PicoCTF Walkthru [24] - Cookies (HTTP Cookie explanation)

[@yoooouval8723]

what a great explanation!!! thorough, concise and still interesting. Im completely new to this so actually succeeding felt great! thanks for that

[@mike_on_tech]

Glad it was helpful!

[@nttn3666]

love your walkthough, please keep making videos

[@mike_on_tech]

Thanks, will do!

[@tpt_transparent5179]

for some reason my gave me Errors No payload positions defined. anyone out there that could help

[@turhanergene5464]

Amazing teacher. Loving the way you teach

[@mike_on_tech]

Thank you! 😃

[@alaaalgladi1473]

in 0:50 what this bage it is tool ?

[@HJ-rj6lx]

Vaav😍 your explanation is superb. Thank you for your video . Please keep going . Already subscribe .❤ from sri lanka. 🇱🇰

[@mike_on_tech]

Thanks. Appreciate the subscription!

[@jenisler7421]

so used burpsuite poxy intercept and intreduer on the cookies: name = -1 so then i highlight the -1 and right click to send to intruder but then only the value changes but not the result so for every value the resulting name remained snickerdoodle

[@CaiN805]

Nice lesson man! I learned a lot! TY!

[@mike_on_tech]

Glad to help!

[@BonkLoud]

I love these pico videos, pls make more

[@mike_on_tech]

Thanks, bit busy with life, but soon!

[@soraaaa4158]

Hi Mike, Great tutorial. I have a question. Can you Tell me how can I do this without using burpsuite? That is how can I write my own code for requesting different cookies and capturing the corresponding results? I would like to do it without using burpsuite for better understanding and grasp. Thank you

[@mike_on_tech]

Sure, there are many ways you can do this. Fundamentally, cookies are just key-value pairs that are passed as a Header in the end of an HTTP message. I'd recommend taking a look at some of the Wireshark tutorials I've put out to get a sense for how simple they really are. There are many ways you can alter these values. I'd start with using your web browser to inspect the Network Traffic that is sent. In Chrome, there's an option to Copy a given HTTP request in a variety of formats. I made a request to Google and copied it as CURL. It looks like this: curl 'www.google.com/' \ -H 'authority: www.google.com' \ -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \ -H 'accept-language: en-US,en;q=0.9' \ -H 'cookie: NID=511=JXY0FZGgpdIoP_uZjXGtJiyvcMIgAimLHlf5XoF_YMGLHKBAQKXw_oRlJedSKvKEHj5AM7JauUQAwyvBpj5UC3WWQJCleKOSr8KL9qVFnTr3tdu8sQIKEOmLfC5hnXZEBCkNs-TyJtcKT5xWNB03E6TcAOEZOpq05iw0EAwucL4; OTZ=6667302_84_88_104280_84_446940; 1P_JAR=2022-09-18-15; AEC=AakniGO4InRvST1SglB3r0LaFQWrM9NxggPE2zJcO96-ZCsidWP75gt-; DV=E7YUQNnJmKwrYHfm0PDGnWWXrR4VNZjkqNWfmvg5SwQAAAA' \ -H 'sec-ch-ua: "Google Chrome";v="105", "Not)A;Brand";v="8", "Chromium";v="105"' \ -H 'sec-ch-ua-arch: "x86"' \ -H 'sec-ch-ua-bitness: "64"' \ -H 'sec-ch-ua-full-version: "105.0.5195.127"' \ -H 'sec-ch-ua-full-version-list: "Google Chrome";v="105.0.5195.127", "Not)A;Brand";v="8.0.0.0", "Chromium";v="105.0.5195.127"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-model: ""' \ -H 'sec-ch-ua-platform: "Windows"' \ -H 'sec-ch-ua-platform-version: "10.0.0"' \ -H 'sec-ch-ua-wow64: ?0' \ -H 'sec-fetch-dest: document' \ -H 'sec-fetch-mode: navigate' \ -H 'sec-fetch-site: none' \ -H 'sec-fetch-user: ?1' \ -H 'upgrade-insecure-requests: 1' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36' \ -H 'x-client-data: CK+1yQEIiLbJAQiktskBCMS2yQEIqZ3KAQjX9MoBCJahywEIibzMAQjrvMwBCNbGzAEIu8nMAQiQy8wBCOPLzAEIntHMAQj10cwBCP3XzAEIoN3MAQ==' \ --compressed Notice the fifth line? That's the Cookie Header. You could then alter that CURL request and re-send. Or you could re-create the call in Python Requests library. Like I said, lots of ways to do this.

[@carolinepeace819]

my payload attack won't work, my "request count" is 0 and i have no clue how to change it

[@carolinepeace819]

and i followed step-by-step this video.. so if you have an idea i need it

[@sahilshah9678]

please please make a video on XtraORdinary pllllllzzzzz!!! picoCTF

[@slaozeren8742]

thank you sir

[@mike_on_tech]

Glad to help