Sessions and cookies

Login → extract session cookie (no redirect)

allow_redirects=False leaves the original 302 response visible instead of automatically requesting its Location. When that status is the application’s confirmed success behavior, the session cookie can then be read from the session’s cookie jar.

r = s.post(url=LOGIN_URL, data=DATA, verify=False, allow_redirects=False, timeout=10)
if r.status_code != 302:
    print("[-] Injection did not work")
    sys.exit(1)
session_cookie = s.cookies.get("session")
print(f"[+] Authenticated — cookie: {session_cookie}")

_{Find by: cookie, session, allow_redirects, 302, set-cookie, authentication, sqli auth bypass, phpsessid · Source: WSA SQLi auth bypass}

requests Session — make a cookie available across paths and Host overrides

requests.Session stores each cookie’s path and domain and checks both before adding the cookie to a request. A cookie received from /api/login may be restricted to /api when the Set-Cookie header contains no explicit path. A later request to /threads/preview then falls outside the stored cookie path. A manually supplied Host header is also considered during cookie-domain matching.

The existing token can be stored again with the root path and no domain restriction:

json = {
    "username": "<USERNAME>",
    "password": "<PASSWORD>"
}
r = s.post(url=f"{URL}/api/login", json=json, verify=False, timeout=10, proxies=PROXIES)
token = s.cookies.get("<COOKIE_NAME>")
s.cookies.set("<COOKIE_NAME>", token, path="/")

headers = {
    "Host": "<OVERRIDDEN_HOST>"
}
r = s.post(url=f"{URL}/threads/preview", headers=headers, verify=False, timeout=10, proxies=PROXIES)

path="/" makes the new cookie eligible for every request path. Leaving the domain unset makes it eligible when the request uses a manually overridden Host value.

_{Find by: requests session, session object, cookie path, path root, cookie jar, cookies set, manual host header, overridden host, missing cookie, login cookie, cross path cookie}

Clear and replace session cookies

Clears cookies collected by earlier requests before a forged or attacker-controlled cookie is supplied to the next stage. s.cookies.set() stores the replacement in the session cookie jar, so every later request made through the session receives it.

s.cookies.clear()
s.cookies.set("<COOKIE_NAME>", forged_cookie)

r = s.get(url=URL, verify=False, timeout=10, proxies=PROXIES)

A cookie required for only one request can instead be passed directly to that request:

s.cookies.clear()

cookies = {
    "<COOKIE_NAME>": forged_cookie
}
r = s.get(url=URL, cookies=cookies, verify=False, timeout=10, proxies=PROXIES)

Both forms send the replacement cookie without retaining cookies from the previous session state.

Cookie: <COOKIE_NAME>=<FORGED_COOKIE>

_{Find by: requests session, clear cookies, set cookie, cookies set, cookie jar, forged cookie, replace cookie, session-wide cookie, session state, phpsessid, authentication state · Source: HTB/TheMagicInformer}