v11 cookie hash

Hi Brian,

 

 

Are you looking for info on how to decode a v11 cookie insert persistence cookie? If so, I don't think much has changed in v11. Have you checked this SOL for info:

 

 

sol6917: Overview of BIG-IP persistence cookie encoding

 

http://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html

 

 

Aaron

Hi Aaron,

Thanks for taking the time to reply back to me. I'm used to seeing a hash with 3 periods in it:

 Set-Cookie: BIGipServerpool_orin_8080=940904714.36895.0000; 

However this cookie does not:

 Set-Cookie: BIGipServerpl_wdp_ext_http=rd1o00000000000000000000ffff0aa06c1eo80; 

Upon further inspection, the given configuration is using route domain which switches the hash. Thanks for the link!

If anyone is intrested, here is a python script:

import struct

import sys

if len(sys.argv) != 2:

print "Usage: %s cookie_value" % sys.argv[0]

exit(1)

encoded_string = sys.argv[1]

print "\n[*] String to decode: %s\n" % encoded_string

(rd, host, port) = encoded_string.split('o')

Hexadecimal details:

iphash = host.replace("00000000000000000000ffff", "")

rdnum = rd.replace("rd", "")

(a, b, c, d) = [ord(i) for i in struct.pack("

print "[*] Decoded IP: %s.%s.%s.%s" % (d, c, b, a)

print "[*] Decoded Port: %s" % port

print "[*] Decoded Route Domain: %s\n" % rdnum

Run the script

bash-3.2$ python rd-decoder.py rd5o00000000000000000000ffffc0000201o80

[*] String to decode: rd5o00000000000000000000ffffc0000201o80

[*] Decoded IP: 192.0.2.1

[*] Decoded Port: 80

[*] Decoded Route Domain: 5