> For the complete documentation index, see [llms.txt](https://infosecgirls.gitbook.io/infosecgirls-training/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infosecgirls.gitbook.io/infosecgirls-training/appsec/some-attack-scenarios/6-null-payload.md).

# Null Payload

**Scenario:** We want to analyze the randomnenss of the `uid` cookie value when the same user logs in repeatedly. What are the consequences if a user's `uid` cookie gets stolen somehow?

1. Send the login request to the `Intruder`, and click on `Clear §` button to remove all payload position markings.
2. Select *attack type* as `Sniper`.

![](/files/-MJxF9f5MOOZ1_h3bB4U)

3\. Navigate to the `Payloads` sub-tab, and select *payload type* as `Null payloads`.

4\. In the `Payload Options [Null payloads]` section, specify the total number of requests to be made.

![](/files/-MJxFHumeIYl43WaNaV4)

5\. Start the attack and observe the `uid` values returned by the server.

![](/files/-MJxFf4_IsSpw6-jCCHq)

6\. We notice that `uid` is set to a constant value for a valid user. Hence, `uid` could be brute-forced in order to gain access to a random user's account.

7\. Intercept the login request for a user, say `user`.

![](/files/-MJxG-lZBfvQnx9KfpjN)

8\. Change the value of `uid`, say from `23` to `30`, and forward the request.

![](/files/-MJxG9wLzE85cQG8hDlf)

![Modify UID](/files/-LWHQwLR2D-KQiusiUQ_)

9\. Observe the value of `Logged-In-User` in the response header. It says `user_3` instead of `user`.

![](/files/-MJxGIkridQWBOiAhgG9)

10\. Just by changing the `uid` value, we could bypass the authentication mechanism and successfully log in as a random user.

![](/files/-MJxGU-nzm02_WWrigDl)