loading
Loading content
loading
Vulnerabilities
Crack weak signing secrets on stateless session cookies.
overview
CookieMonster targets signed, stateless session cookies: the ones that pack state into a cookie instead of a server-side store. Point -cookie at a value (or -url at a page that sets one), decode the scheme, then grind candidate keys from -wordlist against the signature until one verifies.
Frameworks such as Django, Flask, Rack/Rails, Laravel, and Express cookie-session are in scope, plus HS256/HS384/HS512 JWTs. After a hit, -resign can forge a Django cookie with new payload data. Raise -concurrency when a large custom wordlist is in play.
Place it after a step that already collected session cookies. It writes a file and a folder. Prefer jwt-tool when the job is JWT header or claim surgery rather than key recovery across cookie schemes.
use cases
Decode a signed session cookie and run a key wordlist against the signature to find apps using a default, dev, or otherwise guessable signing secret.
Once the key is recovered, resign a Django cookie with new data to prove privilege escalation or account takeover in a report.
Point CookieMonster at a URL with -url so it fetches the Set-Cookie session value itself instead of you pasting one by hand.
Feed cookies from Django, Flask, Rack, Express, Laravel, and JWT-based apps and let CookieMonster detect each scheme and try the same key list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| cookie | STRING | -cookie | The cookie to attempt to decode and unsign. |
| url | STRING | -url | An HTTP URL to fetch the session cookie from instead of supplying one. |
| wordlist | FILE | -wordlist | Path to a base64-encoded key wordlist (default is the builtin list). |
| resign | STRING | -resign | Unencoded data to resign the cookie with (Django only). |
| concurrency | STRING | -concurrency | How many attempts run concurrently (default 100). |
| verbose | BOOLEAN | -verbose | Show additional output on how the cookie is decoded. |
Showing key inputs. cookiemonster exposes 6 inputs in total.
example
# pull the session cookie from a URL and crack its signing key against a custom listcookiemonster -url https://app.example.com/ -wordlist secret-keys.b64 -concurrency 200🍪 CookieMonster 1.3.0ℹ️ CookieMonster loaded the default wordlist; it has 38919 entries.ℹ️ CookieMonster fetched a session cookie from https://app.example.com/.✅ Success! I discovered the key for this cookie with the django decoder; it is "changeme".ℹ️ CookieMonster resigned your cookie with the recovered key.🍪 gAJ9cQFYBAAAAHJvbGVxAlgFAAAAYWRtaW5xA3Mu:1sXkQe:h3Kd0pR7nZ2xL0hJ6gguidance
Use CookieMonster when you have a signed session cookie and need to know whether its secret is crackable offline. Skip opaque server-side session ids. For JWT-specific tampering beyond HMAC key recovery, use jwt-tool.
JWT decode and attack surface. CookieMonster covers signed cookies across several framework schemes plus HMAC JWT key recovery.
General-purpose cracker. CookieMonster is purpose-built for cookie signing schemes and Django resign.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A target URL feeds CookieMonster, which pulls the session cookie, cracks its signing key against a wordlist, and writes the result as output.
Facts on this page come from the live Trickest tool library.