Skip to content

Instantly share code, notes, and snippets.

@d6y
Created August 3, 2013 11:36
Show Gist options
  • Select an option

  • Save d6y/6146157 to your computer and use it in GitHub Desktop.

Select an option

Save d6y/6146157 to your computer and use it in GitHub Desktop.
~$ cd guess/
guess$ ls
correct_guess incorrect_guess test
guess$ cat test
HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Sat, 03 Aug 2013 11:03:49 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 12671
Connection: keep-alive
Expires: Sat, 3 Aug 2013 11:03:49 GMT
Set-Cookie: JSESSIONID=b5zkjbmmfu0e;Path=/
Cache-Control: no-cache, private, no-store
Pragma: no-cache
X-Lift-Version: 3.0-SNAPSHOT
X-NO-BREACH: JSESSIONID=jsk3kfls9qo0e JSESSIONID=0sld92laxao1 JSESSIONID=hwpq02kdlwa1
Start correctly guessing the real JSESSION value:
guess$ cd correct_guess/
correct_guess$ cp ../test ./test
correct_guess$ gzip -c test > test.1
correct_guess$ echo -n "Set-Cookie: JSESSIONID=b" >> test
correct_guess$ gzip -c test > test.2
correct_guess$ echo -n "5zkj" >> test
correct_guess$ gzip -c test > test.3
correct_guess$ gzip -l --verbose test.*
method crc date time compressed uncompressed ratio uncompressed_name
defla b8ca316d Aug 3 12:31 309 413 32.7% test.1
defla 6c0620b4 Aug 3 12:31 310 437 36.2% test.2
defla 2cba15fb Aug 3 12:31 311 441 36.5% test.3
930 1291 30.4% (totals)
Start incorrectly guessing the JSESSION value:
guess$ cd incorrect_guess/
incorrect_guess$ cp ../test .
incorrect_guess$ gzip -c test > test.1
incorrect_guess$ echo -n "Set-Cookie: JSESSIONID=a" >> test
incorrect_guess$ gzip -c test > test.2
incorrect_guess$ echo -n "kk0r" >> test
incorrect_guess$ gzip -c test > test.3
incorrect_guess$ gzip -l --verbose test.*
method crc date time compressed uncompressed ratio uncompressed_name
defla b8ca316d Aug 3 12:31 309 413 32.7% test.1
defla f50f710e Aug 3 12:32 311 437 35.9% test.2
defla 170fc234 Aug 3 12:32 313 441 36.1% test.3
933 1291 30.1% (totals)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment