Waraxe IT Security Portal

Vixje · Active user

Hi there,

I have setup a test account and managed to steal my own cookie. I guess this was the easy part. Here's the output of my cookie stealer:

Cookie: phpbb2mysql_t=a:1:{i:110;i:1145043838;}; phpbb2mysql_data=a:2:{s:11:\"autologinid\";s:33:\"205340551044400583937258.37903461\";s:6:\"userid\";i:193;}; phpbb2mysql_sid=dd583d8eb8a767dcaf15efc2f751a272
IP: 210.14.4.82
Date and Time: 14 April, 2006, 10:27 pm
Referer: http://10.23.44.4/forum/posting.php

I'm really having a hard time decyphering this and reading a hash from it. I can see the session id, but i dont think this would help me much since you always need to relog when u enter admin cp.

Any gurus out there?

Indiction · Regular user

Vixje · Active user

Hmm weird, I always assumed phpbb uses md5. Guess i was wrong Wink

beastyarny · Regular user

it's not a hash, this is user identifier in phpbb forum version 2.0.18/19....
so it cann't be decoded. the real hash is stored in data base and didn't transmitted in cookies

syntax9 · Active user

beastyarny if you know of a way with .18 / .19 with the new indentifier please let me know, ive been trying for months on a certain site and i always get the same cookies with the decial. 31 bit hash.