> For the complete documentation index, see [llms.txt](https://infosecgirls.gitbook.io/infosecgirls-training/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infosecgirls.gitbook.io/infosecgirls-training/appsec/some-attack-scenarios/6-null-payload.md).

# Null Payload

**Scenario:** We want to analyze the randomnenss of the `uid` cookie value when the same user logs in repeatedly. What are the consequences if a user's `uid` cookie gets stolen somehow?

1. Send the login request to the `Intruder`, and click on `Clear §` button to remove all payload position markings.
2. Select *attack type* as `Sniper`.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxF9f5MOOZ1_h3bB4U%2Fimage.png?alt=media\&token=86771051-b316-4c10-9ef8-4efeddea6b50)

3\. Navigate to the `Payloads` sub-tab, and select *payload type* as `Null payloads`.

4\. In the `Payload Options [Null payloads]` section, specify the total number of requests to be made.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxFHumeIYl43WaNaV4%2Fimage.png?alt=media\&token=ff130159-6779-4541-a8bb-743bed1e139d)

5\. Start the attack and observe the `uid` values returned by the server.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxFf4_IsSpw6-jCCHq%2Fimage.png?alt=media\&token=6d817828-af97-426a-ab73-d6bae7197d49)

6\. We notice that `uid` is set to a constant value for a valid user. Hence, `uid` could be brute-forced in order to gain access to a random user's account.

7\. Intercept the login request for a user, say `user`.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxG-lZBfvQnx9KfpjN%2Fimage.png?alt=media\&token=4dc33724-595c-45f4-b3b3-3573897c97ee)

8\. Change the value of `uid`, say from `23` to `30`, and forward the request.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxG9wLzE85cQG8hDlf%2Fimage.png?alt=media\&token=d49c4d11-68c1-4650-8e17-5130cb8b63cd)

![Modify UID](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LWHQt-EMiiOHTuosAKW%2F-LWHQwLR2D-KQiusiUQ_%2F18-null-payload.png?generation=1547571284873074\&alt=media)

9\. Observe the value of `Logged-In-User` in the response header. It says `user_3` instead of `user`.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxGIkridQWBOiAhgG9%2Fimage.png?alt=media\&token=7c305353-7e58-4b35-91bb-5fe4b27d7a69)

10\. Just by changing the `uid` value, we could bypass the authentication mechanism and successfully log in as a random user.

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-MJxEiZix0CCmc0VqoR-%2F-MJxGU-nzm02_WWrigDl%2Fimage.png?alt=media\&token=ae790a2d-a0ef-41e5-9d67-d32958e17b4f)