In webapplications, session id or some user id will be encoded in urls like, http://localhost/login.jsp;jsessionid=25698FG34. In this example 25698FG34 is the session identifier.Mainly these sessionids can be found in two ways,they are as follows
1.Cookie
2.HTML body
Inorder to retrieve the sessionid from cookie use the following code,
Load Response_Info Header on 4 Into VAR_UID ,WITH "Set-Cookie,UID"
Inorder to retrieve the sessionid from html body use the following code,
LOAD RESPONSE_INFO BODY ON 5 INTO VAR_SID ,WITH "HTML(0)/BODY(1)/FORM(2)/TABLE(4)/TBODY(0)/TR(0)/TD(0)/A(0):ATTRIBUTE:onclick(0)"
SET VAR_STRLEN = ~LENGTH(VAR_SID)
SET VAR_STRLEN = VAR_STRLEN - 2
SET VAR_SID = ~LEFTSTR(VAR_STRLEN, VAR_SID)
SET VAR_SEPPOS = ~LOCATE("','", VAR_SID)
SET VAR_SEPPOS = VAR_SEPPOS + 3
SET VAR_STRLEN = ~LENGTH(VAR_SID)
SET VAR_STRLEN = VAR_STRLEN - VAR_SEPPOS
SET VAR_SID = ~RIGHTSTR(VAR_STRLEN, VAR_SID)
Once the desired ID has been obtained, it can be concatenated into applicable URLs as shown below:
"http://localhost/login.jsp;jsessionid=" + VAR_SID
No comments:
Post a Comment