0

TL; DR

Is there any way you might suggest decrypting this cookie? It was saved under the name mail, so I suspect it encrypts an email address:

4520382156EFC790B5B54696C4E175B5695F03D2D59C33858A62D6CDA18B7AB2

Edit: Here is another one using another account:

BFE069DB7B7FDED51A7F81DF8CE3CAD8FB8B14D70BE3FA32F26C4A2136170CD6

Motivation

When using a web portal, I noticed the same cookie is generated for my username every single time (i.e., it does not appear to be random). My concern is that there are several API endpoints with private info that can be accessed anonymously just using said string in the URL. I suspect the string is a kind of user identifier, but I am not sure if it is generated using the values from my email address, or randomly based on time of creation.

More details

I can't go into specifics as I don't want this flaw to be exposed, compromising my info and getting me into trouble. However I know the portal is hosted on Microsoft IIS Server and built using the ASP.NET framework. I also suspect the implementation is rudimentary, so they probably aren't doing anything more sophisticated.

Improve this question
3
  • Might be possible might be not, it's not possible to tell using information you provided. If the length is const no matter how long is your mail it's probably hasing function and you can't recover data from it.
    – morsisko
    Feb 24 at 21:17
  • 1
    Looks like a hash, length matches a sha256 hash...
    – Remko
    Feb 24 at 22:24
  • As the data is hex encoded I would also assume it is a hash value. Encrypted values are often larger and therefore more often base64 encoded as it is more efficient. Reconstructing a hash is very complicated as you don't know what additional data is included in the hash.
    – Robert
    Feb 25 at 8:47
0

Findings

After some digging around in GitHub (turns out several of the portal component's source code is worryingly on GitHub, although I had to decompile it), I discovered that the string is generated using the AES Rijndael Algorithm.

I was able to succesfully generate the second string using an arbitrary key like "#lk$.346hopHXIsd" (changed for security reasons). I was unable to do the same for the first one. I suspect a different key is used as both emails correspond to two different kinds of users. I will draft a program that will brute force several keys until it finds a match. Will report back in case this helps (or entertains) anyone.

Edit:

I found a GitHub repo that did several requests to the server, so figured it might have some answers. After browsing through the code, and decompiling a source file (conveniently named Authentication), I extracted the key.

Edit 2:

The key matched one of the cyphered strings. However, as @Robert points out, it is virtually impossible to brute force the algorithm. I will try other methods. I leave this thread open to suggestions and in case it is of help to anyone :D

Edit 3: Solved.

Improve this answer
2
  • 1
    Good luck, unless the AES key generator respectively password generator is not totally broken a brute-force attack may require a few dozen up to a few hundred years.
    – Robert
    Feb 28 at 15:37
  • LOL, yup. Got excited when it worked and I assumed it would be pretty straightforward then. I then realized the millions of combinations needed and how the algorithm is designed to prevent such brute force attacks. Will try to search for similar code online to test my luck. Thanks for the answer :D
    – edvilme
    Mar 1 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.