O'Reilly logo

Burp Suite Cookbook by Sunny Wear

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

How to do it...

Let's try to decode the value of the session token PHPSESSID found in the OWASP Mutillidae II application. When a user initially browses to the URL (http://<Your_VM_Assigned_IP_Address>/mutillidae/), that user will be assigned a PHPSESSID cookie. The PHPSESSID value appears to be encrypted and then wrapped in base 64 encoding. Using Decoder, we can unwrap the value.

  1. Browse to the http://<Your_VM_Assigned_IP_Address>/mutillidae/ application. 
  2. Find the HTTP request you just generated from your browse within the Proxy | HTTP history tab (shown in the next screenshot). Highlight the PHPSESSID value, not the parameter name, right-click, and select Send to Decoder:
  1. In the Decoder tab, in the Decode as… drop-down as follows, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required