EH-05: Session Management - Cookie, Token, CSRF

cd ~ && mkdir -p eth-lab5 && cd eth-lab5

cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify, make_response
import secrets

app = Flask(__name__)
sessions = {}

@app.route('/login', methods=['POST'])
def login():
    token = secrets.token_hex(16)
    sessions[token] = {"user": "admin", "role": "admin"}
    resp = make_response(jsonify({"token": token}))
    resp.set_cookie("session", token, httponly=True)
    return resp

@app.route('/profile')
def profile():
    token = request.cookies.get('session') or request.headers.get('X-Session')
    if token in sessions:
        return jsonify(sessions[token])
    return jsonify({"error": "No session"}), 401

@app.route('/admin')
def admin():
    token = request.cookies.get('session')
    if token in sessions and sessions[token]['role'] == 'admin':
        return jsonify({"flag": "FLAG{Session_Management}"})
    return jsonify({"error": "Forbidden"}), 403

app.run(port=9003)
PYEOF

python3 server.py &
sleep 1

# 1. Login → get session
echo "=== 1. Login ==*"
RESP=$(curl -s -c /tmp/cookies.txt -X POST http://localhost:9003/login)
echo "$RESP"

# 2. Profile with cookie
echo ""
echo "=== 2. Profile (with cookie) ==*"
curl -s -b /tmp/cookies.txt http://localhost:9003/profile

# 3. Admin with cookie
echo ""
echo "=== 3. Admin (with cookie) ==*"
curl -s -b /tmp/cookies.txt http://localhost:9003/admin | grep -o 'flag{.*}'

# 4. Predictable session test
echo ""
echo "=== 4. Session Predictability ==*"
echo "Token1: $(echo $RESP | grep -o '[a-f0-9]\{32\}')"
echo "Apakah token mudah ditebak? Jika sequential → bisa session hijacking!"

kill %1 2>/dev/null