I'm trying to do cookie poisoning on my local phpbb forum, but can't do it...

So i would appreciate some tutorials, papers, or any help....

Searched around, but couldnt seem to find anything usefull, although it seems quite popular method!

Go with a web proxy like Spike, Web Proxy and any other web proxy.

You may read this article serie
http://www.securityfocus.com/infocus/1722

thnx.

I was using WebSleuth.

Still dont quite understand how to inject cookie. Tried just to inject MD5 hash, but that doesent work, becouse i need to put in session data, but dont understand how to create that. And there seems to be some other data also.

And i dont have enough will to studie the code from phpbb...

So any help would be welcome!

read my post in this thread for editing the cookie (i think thats what ur after?)
http://www.governmentsecurity.org/forum/in...l=iecookiesview

you need the md5 hash, user name and user ID. thats all

I did it in the mean time.
Thanks all for help it was usefull.

I was looking for code that was creating cookie data, so i had to examine the code a lot. But finaly i cracked it. U need cookie name, MD5 hash and user id, serialize it and url encode it.

That's it! Preaty simple after all.