Hack Forums
PHPSESSID trouble - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: PHPSESSID trouble (/showthread.php?tid=5150112)

PHPSESSID trouble - Nope.exe - Jan 28, 2016

I'm working on making a bot for visitstomoney.com so I can up my profits, but I need to figure out how the phpsessid is generated. I know it's based on IP, but other than that I've learned nothing in my googling that helps.

EDIT: After lots of googling I'm seeing some people saying it's entirely random, some say it's just serialized and some also say it's something to do with php's md5() function. Basically the only thing bugging me is that my bot is returning a bad request error code. Maybe someone will be able to tell me why. Here's the request being sent:

std::string request = std::string("GET / HTTP/1.1\r\nHost: ") + host + "\r\nUser-Agent: " + userAgent + "\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-US,en;q=0.5\r\nAccept :text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nPHPSESSID: yqvjg72ot96xukxfxgj12so1nq/*randomly generated phpsessid*/\r\nDNT: 1\r\nConnection: close\r\n\r\n";

user agent i'm testing with is: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0
host i'm using is:http://VisitsToMoney.com/index.php?refId=755770 //my ref code, that way I can test if it shows up

Also, the X-GC error is: 0.DNS_FAIL.JS-MOBILE-RC-01_183_207_203_8

* - Fozo - Jan 28, 2016

I can't post links yet sorry: github(dot)com/php/php-src/blob/d9bfe06194ae8f760cb43a3e7120d0503f327398/ext/session/session.c#L284

From what I can tell, it's generated with your IP, current server time, and a random number generator.

* - Nope.exe - Jan 28, 2016

Thanks man, if you want if/when I get my bot working ik give you a free copy xD
That being said, If you're up to it (and you know c/c++) I could use some help. Mostly just with the phpsessid thing but I'm also doing a Web page scraper to get proxies so...

* - Fozo - Jan 29, 2016

You could just throw a bunch of HTTP HEAD requests at it, capturing the PHPSESSID from the Set-Cookie headers. Example with
Code
curl
(on linux):

Code
censored@ubuntu:~$ curl VisitsToMoney.com -i -X HEAD
HTTP/1.1 200 OK
Date: Fri, 29 Jan 2016 07:02:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=d6pdrdsl9vrb0b54gs4sfv3j37; path=/
Content-Type: text/html

Using this and some bash, you can generate cookies very quickly:
Spoiler (Click to View)

* - Nope.exe - Jan 29, 2016

wait, you're getting multiple different phpsessid's but every time that i've used httpfox and checked the data after actually connecting I get the same results. Forgive me for being a noob, but how is curl generating these cookies?

* - Fozo - Jan 29, 2016

(Jan 29, 2016 10:35 AM)Nope.exe Wrote:  wait, you're getting multiple different phpsessid's but every time that i've used httpfox and checked the data after actually connecting I get the same results. Forgive me for being a noob, but how is curl generating these cookies?

It's just establishing a new connection to each. On each connection it does not give the server a PHPSESSID cookie, so the server generates a new one. HTTPFox is probably keeping the PHPSESSID cookie and re-using it in each connection.

* - Nope.exe - Jan 29, 2016

So in my request if I don't send a phpsessid, that should be fine then? And thanks so much for your help man

* - Αlpha - Jan 29, 2016

I assume you are writing this in C++. The thing you are looking for is called a cookie jar.
I am not sure if it's easy to implement something like a cookie jar in C++, maybe look at a higher level language like Python, Java etc.

* - Fozo - Jan 29, 2016

(Jan 29, 2016 02:32 PM)Nope.exe Wrote:  So in my request if I don't send a phpsessid, that should be fine then? And thanks so much for your help man

Yeah, it should generate one for you.

I accidentally left my script running last night and have ~110,000 PHPSESSID cookies for that site, lmk if you want them :P

* - Nope.exe - Jan 30, 2016

Well if the request doesn't actually need to have a cookie then I might pass, if not I could just have my bot select one from the file for each visit. What do you think I should do?