[{"data":1,"prerenderedAt":759},["ShallowReactive",2],{"page-\u002Ftools\u002Fcookie-lab":3,"all-pages":426},{"id":4,"title":5,"body":6,"description":417,"extension":418,"meta":419,"navigation":420,"path":110,"robots":421,"seo":422,"sitemap":423,"stem":424,"__hash__":425},"content\u002F14.tools\u002F1.cookie-lab.md","Cookie Lab",{"type":7,"value":8,"toc":400},"minimark",[9,13,25,30,33,72,75,79,91,98,102,142,147,150,196,203,207,210,243,246,250,253,257,260,339,342,346,393,397],[10,11,5],"h1",{"id":12},"cookie-lab",[14,15,16,17,24],"p",{},"The Cookie Lab decodes and unsigns vulnerable stateless session cookies using a\nnative Rust port of\n",[18,19,23],"a",{"href":20,"rel":21},"https:\u002F\u002Fgithub.com\u002Fiangcarroll\u002Fcookiemonster",[22],"nofollow","CookieMonster",". Crack a single\ncookie in your browser — the cookie and any wordlist you load never leave the\npage — or queue a batch across your runners.",[26,27,29],"h2",{"id":28},"what-it-detects","What it detects",[14,31,32],{},"Cookie Lab decodes cookies from several frameworks and then tries to recover\nthe signing key from a wordlist:",[34,35,36,40,43,46,54,57,60,63,66,69],"ul",{},[37,38,39],"li",{},"Django",[37,41,42],{},"Flask and itsdangerous",[37,44,45],{},"Rack",[37,47,48,49,53],{},"Express (",[50,51,52],"code",{},"cookie-session",")",[37,55,56],{},"Laravel",[37,58,59],{},"CodeIgniter",[37,61,62],{},"WordPress authentication cookies",[37,64,65],{},"Yii2 signed cookies",[37,67,68],{},"Spring Security remember-me cookies",[37,70,71],{},"raw JSON Web Tokens (HS256\u002FHS384\u002FHS512)",[14,73,74],{},"A recovered key means the target signs sessions with a guessable secret, so an\nattacker can forge a session and impersonate any user. Report the finding and\nask the owner to rotate the signing secret.",[26,76,78],{"id":77},"cookie-types","Cookie types",[14,80,81,82,86,87,90],{},"Pick a ",[83,84,85],"strong",{},"Cookie type"," to force one framework, or leave it on ",[83,88,89],{},"Auto-detect",".\nAs you paste a cookie, Cookie Lab parses it locally and shows the formats that\nunderstand it, the signing algorithm it implies, and the decoded payload — no\nwordlist needed. If you force a type that does not match, the lab warns you and\nsuggests switching back to Auto-detect.",[14,92,93,94,97],{},"The selected type is recorded with each run (for example ",[50,95,96],{},"decoder=flask,jwt","),\nso the backlog shows what a run was testing instead of an opaque \"auto\".",[26,99,101],{"id":100},"using-the-lab","Using the lab",[103,104,105,112,130,136],"ol",{},[37,106,107,108,111],{},"Open ",[18,109,5],{"href":110},"\u002Ftools\u002Fcookie-lab",".",[37,113,114,115,117,118,121,122,125,126,129],{},"Paste the session cookie you are authorized to test. For Express\n",[50,116,52],{},", use the ",[50,119,120],{},"name=value^signature"," form. Pasting a whole\n",[50,123,124],{},"Set-Cookie"," header is fine — a ",[83,127,128],{},"strip attributes"," shortcut keeps just the\ncookie value.",[37,131,132,133,135],{},"Choose a wordlist. A wordlist is required — Cookie Lab bundles no default\nlist. ",[83,134,89],{}," reads either a plain-text list (one key per line) or a\nbase64 (Flask-Unsign) list; you can force the format instead. Uploading or\npasting both work, and the lab shows the detected format, entry count, and a\npreview. For WordPress and Spring Security the entry format differs; see\nbelow.",[37,137,138,139,111],{},"Click ",[83,140,141],{},"Decode & crack",[143,144,146],"h3",{"id":145},"wordpress-and-spring-security-wordlist-entries","WordPress and Spring Security wordlist entries",[14,148,149],{},"Most frameworks use the wordlist entry directly as the signing secret. Two\nframeworks derive the signature from material that is not stored in the cookie:",[34,151,152,182],{},[37,153,154,157,158,161,162,165,166,169,170,173,174,177,178,181],{},[83,155,156],{},"WordPress"," derives its HMAC key from the scheme salt (",[50,159,160],{},"AUTH_KEY"," +\n",[50,163,164],{},"AUTH_SALT",", or the ",[50,167,168],{},"LOGGED_IN_","\u002F",[50,171,172],{},"SECURE_AUTH_"," pair) and a four-character\nfragment of the user's password hash. Use ",[50,175,176],{},"salt:pass_frag"," as the entry, or\nthe already derived ",[50,179,180],{},"wp_hash()"," key. The entry is split on the last colon\nbecause WordPress salts may contain colons.",[37,183,184,187,188,191,192,195],{},[83,185,186],{},"Spring Security"," remember-me tokens sign\n",[50,189,190],{},"username:expiry:password:key",". Use the combined ",[50,193,194],{},"password:key"," suffix as the\nentry; the password is usually the stored hash Spring sees.",[14,197,198,199,202],{},"If a key is recovered, the result shows the matching decoder(s), the algorithm,\nthe decoded payload, and the key. The optional ",[83,200,201],{},"Resign"," field re-signs a\ndecoded Django or Flask cookie with new content. A few example cookies are\nbuilt in so you can try the lab before pointing it at a target.",[26,204,206],{"id":205},"local-vs-runner","Local vs runner",[14,208,209],{},"The lab has two backends:",[34,211,212,222],{},[37,213,214,217,218,221],{},[83,215,216],{},"In your browser"," cracks a ",[83,219,220],{},"single"," cookie instantly using the\nCookie Lab WebAssembly build. The cookie never leaves the browser.\nCracking is single-threaded, so large wordlists are capped at 10 MB.",[37,223,224,227,228,231,232,235,236,238,239,242],{},[83,225,226],{},"On your runners"," is a ",[83,229,230],{},"queue",". Paste one cookie per line and each becomes\nits own run; your connected runners pull them as they free up, so a batch of\n50 runs spreads across 5 runners automatically. Each row is type-checked\nbefore it is queued, and the batch summary counts the detected frameworks.\nThe backlog lists every run with its live state, detected type, and result\n(the recovered key), and you can open a run to stream its output or cancel it.\nYou can also ",[83,233,234],{},"fetch a URL"," instead of pasting cookies: the runner grabs the\n",[50,237,124],{}," headers from that URL and cracks them. A wordlist is uploaded\nonce to object storage and shared by the whole batch. Submitting and\ncancelling require a token with the ",[83,240,241],{},"Tool Runs"," write scope; reading\nrequires the read scope. The runner decodes and unsigns cookies natively — no\ntoolchain download and no network access beyond the cookie or URL you provide.",[14,244,245],{},"Notifications for finished runs are not wired up yet.",[26,247,249],{"id":248},"reliability","Reliability",[14,251,252],{},"Queued runs are persisted in the platform database, not a transient cache, so\nthey survive hub and runner restarts. A run claimed by a runner carries a lease\nthat the runner renews on its heartbeat; if the runner dies mid-run the lease\nexpires and the run is automatically re-queued for another runner. Redis only\ncarries wake-up notifications — a Redis restart can delay a pickup by a few\nseconds but never loses a run.",[26,254,256],{"id":255},"limits","Limits",[14,258,259],{},"Tool runs are limited per plan, per account (across all your runners):",[261,262,263,285],"table",{},[264,265,266],"thead",{},[267,268,269,273,276,279,282],"tr",{},[270,271,272],"th",{},"Plan",[270,274,275],{},"Concurrent",[270,277,278],{},"Queued",[270,280,281],{},"Starts \u002F min",[270,283,284],{},"Retention",[286,287,288,306,322],"tbody",{},[267,289,290,294,297,300,303],{},[291,292,293],"td",{},"Free",[291,295,296],{},"5",[291,298,299],{},"100",[291,301,302],{},"15",[291,304,305],{},"7 days",[267,307,308,311,313,316,319],{},[291,309,310],{},"Pro",[291,312,302],{},[291,314,315],{},"500",[291,317,318],{},"45",[291,320,321],{},"30 days",[267,323,324,327,330,333,336],{},[291,325,326],{},"Elite",[291,328,329],{},"40",[291,331,332],{},"2000",[291,334,335],{},"120",[291,337,338],{},"90 days",[14,340,341],{},"Extra runs wait in the queue until a slot frees. Submitting past the queue cap\nis rejected. Finished runs are deleted after the retention window.",[26,343,345],{"id":344},"automating-it","Automating it",[14,347,348,349,352,353,356,357,360,361,364,365,368,369,372,373,376,377,380,381,384,385,388,389,111],{},"For scheduled or dataset-driven use, the same tool is available as the platform\nmodule ",[50,350,351],{},"bountyhub\u002Fcookielab"," and the ",[50,354,355],{},"cookie-session-audit"," workflow\ntemplate. The module accepts ",[50,358,359],{},"decoder"," (a comma-separated format list, or\n",[50,362,363],{},"auto",") and ",[50,366,367],{},"wordlist_format"," (",[50,370,371],{},"base64"," or ",[50,374,375],{},"plain",") alongside ",[50,378,379],{},"cookie",", ",[50,382,383],{},"url",",\nand ",[50,386,387],{},"wordlist",". See ",[18,390,392],{"href":391},"\u002Fworkflows\u002Fmodules","Modules",[26,394,396],{"id":395},"authorization","Authorization",[14,398,399],{},"Only test sessions you are permitted to assess. This tool exists to validate\nyour own deployments or authorized engagement targets.",{"title":401,"searchDepth":402,"depth":403,"links":404},"",5,4,[405,407,408,412,413,414,415,416],{"id":28,"depth":406,"text":29},2,{"id":77,"depth":406,"text":78},{"id":100,"depth":406,"text":101,"children":409},[410],{"id":145,"depth":411,"text":146},3,{"id":205,"depth":406,"text":206},{"id":248,"depth":406,"text":249},{"id":255,"depth":406,"text":256},{"id":344,"depth":406,"text":345},{"id":395,"depth":406,"text":396},"Decode and unsign vulnerable stateless session cookies with Cookie Lab, entirely in your browser.","md",{},true,null,{"title":5,"description":417},{"loc":110},"14.tools\u002F1.cookie-lab","hzGyPgFlLTqOi__m-k3LE3phVj41FheUqxwHzrTF8rs",[427,488,504,523,558,574,586,597,608,619,643,662,682,693,701],{"title":428,"path":429,"stem":430,"children":431},"Workflows","\u002Fworkflows","01.workflows",[432,434,438,442,446,450,454,458,462,466,468,472,476,480,484],{"title":428,"path":429,"stem":433},"01.workflows\u002Findex",{"title":435,"path":436,"stem":437},"Workflow Quick Reference","\u002Fworkflows\u002Fquick-reference","01.workflows\u002F00.quick-reference",{"title":439,"path":440,"stem":441},"Workflows Overview","\u002Fworkflows\u002Foverview","01.workflows\u002F01.overview",{"title":443,"path":444,"stem":445},"Workflow Syntax Reference","\u002Fworkflows\u002Fsyntax-reference","01.workflows\u002F02.syntax-reference",{"title":447,"path":448,"stem":449},"Steps","\u002Fworkflows\u002Fsteps","01.workflows\u002F03.steps",{"title":451,"path":452,"stem":453},"Step Outputs","\u002Fworkflows\u002Fstep-outputs","01.workflows\u002F04.step-outputs",{"title":455,"path":456,"stem":457},"Concurrency","\u002Fworkflows\u002Fconcurrency","01.workflows\u002F05.concurrency",{"title":459,"path":460,"stem":461},"Transforms","\u002Fworkflows\u002Ftransforms","01.workflows\u002F06.transforms",{"title":463,"path":464,"stem":465},"For Each","\u002Fworkflows\u002Ffor-each","01.workflows\u002F07.for-each",{"title":392,"path":391,"stem":467},"01.workflows\u002F08.modules",{"title":469,"path":470,"stem":471},"Agents","\u002Fworkflows\u002Fagents","01.workflows\u002F09.agents",{"title":473,"path":474,"stem":475},"Decisions","\u002Fworkflows\u002Fdecisions","01.workflows\u002F10.decisions",{"title":477,"path":478,"stem":479},"Configuration References","\u002Fworkflows\u002Fconfig","01.workflows\u002F11.config",{"title":481,"path":482,"stem":483},"Comparison With Other Automation Systems","\u002Fworkflows\u002Fcomparison","01.workflows\u002F12.comparison",{"title":485,"path":486,"stem":487},"Generate with AI","\u002Fworkflows\u002Fai-generation","01.workflows\u002F13.ai-generation",{"title":489,"path":490,"stem":491,"children":492},"Projects","\u002Fprojects","02.projects",[493,496,500],{"title":494,"path":490,"stem":495},"Projects & Runs","02.projects\u002Findex",{"title":497,"path":498,"stem":499},"Projects Overview","\u002Fprojects\u002Foverview","02.projects\u002F1.overview",{"title":501,"path":502,"stem":503},"Runs & Artifacts","\u002Fprojects\u002Fruns-artifacts","02.projects\u002F2.runs-artifacts",{"title":505,"path":506,"stem":507,"children":508},"Runners","\u002Frunners","03.runners",[509,511,515,519],{"title":505,"path":506,"stem":510},"03.runners\u002Findex",{"title":512,"path":513,"stem":514},"Runner Overview","\u002Frunners\u002Foverview","03.runners\u002F1.overview",{"title":516,"path":517,"stem":518},"Getting Started with Runners","\u002Frunners\u002Fgetting-started","03.runners\u002F2.getting-started",{"title":520,"path":521,"stem":522},"Custom Runner Images","\u002Frunners\u002Fcustom-image","03.runners\u002F3.custom-image",{"title":524,"path":525,"stem":526,"children":527},"Datasets","\u002Fdatasets","04.datasets",[528,530,534,538,542,546,550,554],{"title":524,"path":525,"stem":529},"04.datasets\u002Findex",{"title":531,"path":532,"stem":533},"Datasets Overview","\u002Fdatasets\u002Foverview","04.datasets\u002F1.overview",{"title":535,"path":536,"stem":537},"Dataset Schemas and Identity","\u002Fdatasets\u002Fschema","04.datasets\u002F2.schema",{"title":539,"path":540,"stem":541},"Pushing and Reading Dataset Rows","\u002Fdatasets\u002Fworkflows","04.datasets\u002F3.workflows",{"title":543,"path":544,"stem":545},"Dataset SQL Reference","\u002Fdatasets\u002Fsql","04.datasets\u002F4.sql",{"title":547,"path":548,"stem":549},"Dataset Structured Filters","\u002Fdatasets\u002Ffilters","04.datasets\u002F5.filters",{"title":551,"path":552,"stem":553},"Dataset Saved Views","\u002Fdatasets\u002Fviews","04.datasets\u002F6.views",{"title":555,"path":556,"stem":557},"Datasets API and CLI","\u002Fdatasets\u002Fapi-cli","04.datasets\u002F7.api-cli",{"title":559,"path":560,"stem":561,"children":562},"Agent","\u002Fagent","05.agent",[563,566,570],{"title":564,"path":560,"stem":565},"BH Agent","05.agent\u002Findex",{"title":567,"path":568,"stem":569},"BH Agent Overview","\u002Fagent\u002Foverview","05.agent\u002F1.overview",{"title":571,"path":572,"stem":573},"MCP servers","\u002Fagent\u002Fmcp-servers","05.agent\u002F2.mcp-servers",{"title":575,"path":576,"stem":577,"children":578},"Bhlast","\u002Fbhlast","06.bhlast",[579,582],{"title":580,"path":576,"stem":581},"Bhlast Servers","06.bhlast\u002Findex",{"title":583,"path":584,"stem":585},"Bhlast servers overview","\u002Fbhlast\u002Foverview","06.bhlast\u002F1.overview",{"title":587,"path":588,"stem":589,"children":590},"Notifications","\u002Fnotifications","07.notifications",[591,593],{"title":587,"path":588,"stem":592},"07.notifications\u002Findex",{"title":594,"path":595,"stem":596},"Notifications Overview","\u002Fnotifications\u002Foverview","07.notifications\u002F1.overview",{"title":598,"path":599,"stem":600,"children":601},"Blob Storage","\u002Fblob-storage","08.blob-storage",[602,604],{"title":598,"path":599,"stem":603},"08.blob-storage\u002Findex",{"title":605,"path":606,"stem":607},"Blob Storage Overview","\u002Fblob-storage\u002Foverview","08.blob-storage\u002F1.overview",{"title":609,"path":610,"stem":611,"children":612},"Payloads","\u002Fpayloads","09.payloads",[613,615],{"title":609,"path":610,"stem":614},"09.payloads\u002Findex",{"title":616,"path":617,"stem":618},"Payloads overview","\u002Fpayloads\u002Foverview","09.payloads\u002F1.overview",{"title":620,"path":621,"stem":622,"children":623},"Cve Watcher","\u002Fcve-watcher","10.cve-watcher",[624,627,631,635,639],{"title":625,"path":621,"stem":626},"CVE Watcher","10.cve-watcher\u002Findex",{"title":628,"path":629,"stem":630},"CVE Watcher Overview","\u002Fcve-watcher\u002Foverview","10.cve-watcher\u002F1.overview",{"title":632,"path":633,"stem":634},"CVE Watcher Search and Filters","\u002Fcve-watcher\u002Fsearch","10.cve-watcher\u002F2.search",{"title":636,"path":637,"stem":638},"CVE Watcher Push Notifications","\u002Fcve-watcher\u002Fnotifications","10.cve-watcher\u002F3.notifications",{"title":640,"path":641,"stem":642},"CVE Watcher API and Scopes","\u002Fcve-watcher\u002Fapi","10.cve-watcher\u002F4.api",{"title":644,"path":645,"stem":646,"children":647},"Developer","\u002Fdeveloper","11.developer",[648,650,654,658],{"title":644,"path":645,"stem":649},"11.developer\u002Findex",{"title":651,"path":652,"stem":653},"Developer Overview","\u002Fdeveloper\u002Foverview","11.developer\u002F1.overview",{"title":655,"path":656,"stem":657},"Personal Access Token Scopes","\u002Fdeveloper\u002Fscopes","11.developer\u002F2.scopes",{"title":659,"path":660,"stem":661},"Personal Access Tokens","\u002Fdeveloper\u002Fpersonal-access-tokens","11.developer\u002F3.personal-access-tokens",{"title":663,"path":664,"stem":665,"children":666},"Bh","\u002Fbh","12.bh",[667,670,674,678],{"title":668,"path":664,"stem":669},"BH CLI","12.bh\u002Findex",{"title":671,"path":672,"stem":673},"BH CLI Overview","\u002Fbh\u002Foverview","12.bh\u002F1.overview",{"title":675,"path":676,"stem":677},"BH CLI Commands","\u002Fbh\u002Fcommands","12.bh\u002F2.commands",{"title":679,"path":680,"stem":681},"BH CLI Examples","\u002Fbh\u002Fexamples","12.bh\u002F3.examples",{"title":683,"path":684,"stem":685,"children":686},"Billing","\u002Fbilling","13.billing",[687,689],{"title":683,"path":684,"stem":688},"13.billing\u002Findex",{"title":690,"path":691,"stem":692},"Billing Overview","\u002Fbilling\u002Foverview","13.billing\u002F1.overview",{"title":694,"path":695,"stem":696,"children":697},"Tools","\u002Ftools","14.tools",[698,700],{"title":694,"path":695,"stem":699},"14.tools\u002Findex",{"title":5,"path":110,"stem":424},{"title":702,"path":703,"stem":704,"children":705},"Site Policies","\u002Fsite-policies","99.site-policies",[706,708,721,725,729,733,737,741,745],{"title":702,"path":703,"stem":707},"99.site-policies\u002Findex",{"title":709,"path":710,"stem":711,"children":712},"Privacy Policy","\u002Fsite-policies\u002Fprivacy-policy","99.site-policies\u002F1.privacy-policy",[713,717],{"title":714,"path":715,"stem":716},"Company Processors","\u002Fsite-policies\u002Fprivacy-policy\u002Fcompany-processors","99.site-policies\u002Fprivacy-policy\u002F1.company-processors",{"title":718,"path":719,"stem":720},"Data Export Instructions","\u002Fsite-policies\u002Fprivacy-policy\u002Fdata-export-instructions","99.site-policies\u002Fprivacy-policy\u002F2.data-export-instructions",{"title":722,"path":723,"stem":724},"Terms of Service","\u002Fsite-policies\u002Fterms-of-service","99.site-policies\u002F2.terms-of-service",{"title":726,"path":727,"stem":728},"California Resident Notice at Collection","\u002Fsite-policies\u002Fccpa","99.site-policies\u002F3.ccpa",{"title":730,"path":731,"stem":732},"Cancellation Policy","\u002Fsite-policies\u002Fcancellation-policy","99.site-policies\u002F4.cancellation-policy",{"title":734,"path":735,"stem":736},"Refund Policy","\u002Fsite-policies\u002Frefund-policy","99.site-policies\u002F5.refund-policy",{"title":738,"path":739,"stem":740},"Taxes on Services","\u002Fsite-policies\u002Ftaxes-on-services","99.site-policies\u002F6.taxes-on-services",{"title":742,"path":743,"stem":744},"Disclaimer","\u002Fsite-policies\u002Fdisclaimer","99.site-policies\u002F7.disclaimer",{"title":746,"path":747,"stem":748,"children":749},"Security","\u002Fsite-policies\u002Fsecurity","99.site-policies\u002Fsecurity\u002Findex",[750,751,755],{"title":746,"path":747,"stem":748},{"title":752,"path":753,"stem":754},"Security Overview","\u002Fsite-policies\u002Fsecurity\u002Fsecurity-overview","99.site-policies\u002Fsecurity\u002F1.security-overview",{"title":756,"path":757,"stem":758},"Security Response","\u002Fsite-policies\u002Fsecurity\u002Fsecurity-response","99.site-policies\u002Fsecurity\u002F2.security-response",1794410312377]