[BT_751]

Hi,

Can you explain me how tu use cookies phpsessid to hack a website?

[0xB9]

You would need to get the site admins phpsessid and use that to hijack his session that way you're logged in as him.

[w0rd]

Let's say you find an LFI and you can include /tmp/sess_[yoursessionid] or wherever it's stored. Now lets say there's a form which stores information about you which is tied to your session - let's go with a contact form.

So you fill in the contact form with your first/last name, email, etc. All of those values are also stored in your session file - so for a PHP based website - put your firstname as

Code

<? $cmd = $_REQUEST['cmd']; passthru($cmd); ?>

Then, utilizing your LFI, you can include your own session file and execute commands.

[BT_751]

I have the PHPSESSID of the server

(PHPSESSID=frdoi87lb034p5mn6g983d1pm3; path=/)

[w0rd]

No.. that's your session ID. The server doesn't have a session ID, it issues them to users.

[BT_751]

I scan the web site using vega and i get a high alert :"Session Cookie Without Secure Flag "
In the Resource Content i find :
"PHPSESSID=frdoi87lb034p5mn6g983d1pm3; path=/"

[w0rd]

All that means is that when the cookie was set, it was not set with the "secure" flag meaning it can be transmitted over http, not strictly SSL/TLS.

[BT_751]

How can i benefit to hack this site web(to know the cookies of the visitors)??