A website stores username and password in a session cookie. In the cookie the
password is "encrypted" or modified in some way. Given that the "encrypted"
version is always the same, I do not believe there is a time sensitive factor.
I could create multiple sets of this data, but it's time consuming.

Knowing this how difficult would it be, and what methods
would be used, to determine what the calculation used is?
To phrase it differently, could one determine how to create a new pair for given plain text?

What does it change if I can determine the hexMD5 value of a known concatenation
of this value and two more. This would be such that I the password, a username,
the "encrypted" password, and a hexMD5 of the username + "encrypted" password
+ a known constant "secret" string. Which makes me think the method is symmetric.

  • $\begingroup$ "I the password" ? $\;$ $\endgroup$ – user991 Apr 23 '15 at 5:40
  • $\begingroup$ Why do you assume the session cookie contains username and password? In your description I see no evidence to support that assumption. Have you tried changing the password and then starting a new session in a fresh browser profile? Have you tried changing the password back to what it was before? Does the cookie grow if you use a longer password? Look at the length of the first cookie and try a password which is longer than that cookie was. If the password is stored in the cookie, the cookie would have to grow. $\endgroup$ – kasperd Apr 23 '15 at 8:05
  • $\begingroup$ Unless you have more information, your best bet is trial and error. Guessing the encryption method is not cryptography - we assume the method to be known to a serious attacker. Maybe the javascripts of the website will tell you more about what is happening there. $\endgroup$ – tylo Apr 23 '15 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.