Lab: Brute-forcing a stay-logged-in cookie
Summary: A PortSwigger lab demonstrates that a stay-logged-in cookie is Base64-encoded and decodes to a username plus a 32-character string that the lab identifies as an MD5 hash of the user's password. The exercise has the user confirm the MD5 construction, then brute-force Carlos's cookie to reach his My account page.
What you should know: A persistent-login cookie built as username plus an unsalted MD5 of the password can be guessed offline and replayed, so the same token that keeps a user signed in can hand an attacker their account.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026