Hey Guys,
Many times we come across 'BIG-IP persistence cookie' during our testings and it looks something like this:
Many times we come across 'BIG-IP persistence cookie' during our testings and it looks something like this:
Ever wondered what it is? If Yes, this is for you !
So, what is this cookie?
In simple words, this cookie is generated when a remote host uses an BIG-IP load balancer.
What does this cookie contain?
When the load-balancer is used, it encodes the IP address of the actual WEB-SERVER (which is being used) and stores it as the cookie value.
Now how to decode it?
Simple! you can use 'Whitehat Big IP Cookie Decoder' to Decode the cookie value.
Behind the Scenes:
For example, if this is the cookie value: 1847044288.47873.0000
It is generally in this format IP . PORT . 0000
Consider the 1st bit i.e. 1847044288 (decimal value)
1. Convert this DECIMAL value to HEX value using http://www.
We have 0x6E17A8C0.
2. Now, split the value into four bytes and reverse the order.
Split: 0x6E 0x17 0xA8 0xC0
Reverse: 0xC0 0xA8 0x17 0x6E
3. Now convert each HEX value to its equivalent DECIMAL value,
After conversion we have 192.168.23.110.
Same goes for the Port value also, 47873 converts to 443.
In the end we have 1847044288.47873.0000 = 192.168.23.110 . 443 . 0000
Hope this helps, Thanks !
