Category:OWASP Cookies Database - Revision history

Lirantal: Updating list of known cookie names with that of the common express-session for NodeJS and Express apps

2016-04-27T21:05:26Z

Updating list of known cookie names with that of the common express-session for NodeJS and Express apps

Simon Ward: /* Cookie Database */ add link to F5 BIG-IP page on cookie encoding

2014-10-22T09:16:21Z

‎Cookie Database: add link to F5 BIG-IP page on cookie encoding

OWASP at 21:57, 25 June 2007

2007-06-25T21:57:57Z

Mmeucci at 15:02, 3 January 2007

2007-01-03T15:02:35Z

Mmeucci at 15:00, 3 January 2007

2007-01-03T15:00:09Z

Javifs: More info on ltpatoken

2006-12-21T10:33:43Z

More info on ltpatoken

Javifs: Two more Domino cookies

2006-12-21T10:13:24Z

Two more Domino cookies

Javifs: More information on IBM cookies

2006-12-21T10:03:12Z

More information on IBM cookies

Javifs: Added a few more cookies

2006-12-21T09:40:50Z

Added a few more cookies

Javifs: Last cookies for today.

2006-12-08T14:52:38Z

Last cookies for today.

@@ Line 592: / Line 592: @@
 |TBD
 |Session-based authentication in a single server, by default, the cookie expires after 30 minutes of inactivity. See http://www.ibm.com/support/docview.wss?uid=swg27003558
 |-

@@ Line 107: / Line 107: @@
 |BIGipServerxxx_xxx_xxx_PROTO
 |2893454590.19741.0000
-|unknown
+|[https://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html Overview of BIG-IP persistence cookie encoding]
 |[http://www.f5.com/ F5]
 |[http://www.f5.com/products/bigip/ F5 BIG-IP]

@@ Line 23: / Line 23: @@
 ==Cookie Database==
-{| align="center" border="1" width="100%"
+{|class="wikitable sortable" style="text-align: center;line-height: 8pt" width="100%"
 |Cookie Name
 |Example Value
@@ Line 592: / Line 593: @@
 |Session-based authentication in a single server, by default, the cookie expires after 30 minutes of inactivity. See http://www.ibm.com/support/docview.wss?uid=swg27003558
+|-
 |Cookie Name
 |Example Value

← Older revision		Revision as of 15:02, 3 January 2007
Line 610:		Line 610:


−	{{Category:OWASP Testing Project}}	+	[[Category:OWASP Testing Project]]

← Older revision		Revision as of 15:00, 3 January 2007
Line 610:		Line 610:


−	[[Category:OWASP Testing Project]]	+	{{Category:OWASP Testing Project}}

@@ Line 527: / Line 527: @@
 |Ltpatoken
 | TBD
-| Base64 encoded. TokenHeader[4 BYTES] +  HexEncoded((DWORD)TokenCreationDate)[8 BYTES] + hexEncoded((DWORD)TokenExpirationDate)[8 BYTES] + Canonicalized username [variable] +  SHA1(TokenHeader + TokenCreation + TokenExpiration + Username+Secret)[20 BYTES]. TokenHeader = First byte reserved, three bytes for secret sequence usage. TokenCreationDate = A number representing the time and date of the token creation. (TokenCreationDate is the number of seconds to elapse since midnight (00:00:00), January 1, 1970) in GMT. TokenExpirationDate = A number representing the time and date of the token expiration. (TokenExpirationDate is the number of seconds to elapse since midnight (00:00:00), January 1, 1970) in GMT
+| Base64 encoding +3DES encryption (ECB mode) using the server's DES password. Contains:  TokenHeader[4 BYTES] +  HexEncoded((DWORD)TokenCreationDate)[8 BYTES] + hexEncoded((DWORD)TokenExpirationDate)[8 BYTES] + Canonicalized username [variable] +  SHA1(TokenHeader + TokenCreation + TokenExpiration + Username+Secret)[20 BYTES]. TokenHeader = First byte reserved, three bytes for secret sequence usage. TokenCreationDate = A number representing the time and date of the token creation. (TokenCreationDate is the number of seconds to elapse since midnight (00:00:00), January 1, 1970) in GMT. TokenExpirationDate = A number representing the time and date of the token expiration. (TokenExpirationDate is the number of seconds to elapse since midnight (00:00:00), January 1, 1970) in GMT
 |[http://www.ibm.org/ IBM]
 |[http://www.ibm.com/software/webservers/appserv/was/ IBM WebSphere Application Server ]
@@ Line 533: / Line 533: @@
 |Application server
 |TBD
-|LTPA (Lightweight Third Party Authentication) is used for Single Sign On. For more information see http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_msso.html
+|LTPA (Lightweight Third Party Authentication) is used for Single Sign On. For more information see http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_msso.html for more information on decoding see http://www.penumbra.org/LWCM/forum.nsf/85255e6f0052055e85255d7f005ed8bc/FF6A0D36B80FBA6E85256CC60077C094?OpenDocument
 |-
@@ Line 549: / Line 549: @@
 |Ltpatoken
 | TBD
-| TBD (Base64 encoded)
+| Base64 encoded, 3-des encrypted: header:server/userDn % timestamps % rsa-signature. Timestamp is the expiration date (in long).
 |[http://www.ibm.org/ IBM]
 |[http://www-128.ibm.com/developerworks/lotus Lotus Domino]
@@ Line 555: / Line 555: @@
 |Application
 |TBD
-|LTPA (Lightweight Third Party Authentication) is used for Single Sign On. For more information see http://www.lotus.com/ldd/labscontent.nsf/lookup/session_auth, http://www.ibm.com/developerworks/ibm/library/it-0101art2/ and http://www.lotus.com/ldd/doc/domino_notes/7.0/help7_admin.nsf/Main?OpenFrameSet. The cookie name can be changed (except for 5.0x servers) based on the iNotes_WA_AuthTokenName configuration variable.
+|LTPA (Lightweight Third Party Authentication) is used for Single Sign On. For more information see http://www.lotus.com/ldd/labscontent.nsf/lookup/session_auth, http://www.ibm.com/developerworks/ibm/library/it-0101art2/ and http://www.lotus.com/ldd/doc/domino_notes/7.0/help7_admin.nsf/Main?OpenFrameSet. The cookie name can be changed (except for 5.0x servers) based on the iNotes_WA_AuthTokenName configuration variable. For more information on decoding see http://www.penumbra.org/LWCM/forum.nsf/85255e6f0052055e85255d7f005ed8bc/FF6A0D36B80FBA6E85256CC60077C094?OpenDocument

@@ Line 260: / Line 260: @@
 |Many
 |None
 |-
@@ Line 339: / Line 361: @@
 |[http://www.ibm.com/software/webservers/appserv/was/ IBM WebSphere Application Server ]
 |TBD
-|Web server
+|Application server
 |Many
 |None
@@ Line 501: / Line 523: @@
 |Many
 |None.
 |}

@@ Line 199: / Line 199: @@
 |unknown
 |[http://www.sun.com/ Sun]
-|[www.sun.com/software/products/appsrvr/index.xml Java System ApplicationServer])
+|[http://www.sun.com/software/products/appsrvr/index.xml Java System ApplicationServer])
 |TBD
 |Application Server
@@ Line 205: / Line 205: @@
 |None.
 |-
@@ Line 227: / Line 237: @@
 |Many
 |None
 |-