I am using a website whose cookies are as following (when I'm as a guest at 3 different instances in increasing order of time) :eyJ0YWxrX3N0YXRlIjowfQ\075\075|1497742098|514507d23a215fcea83c80608ba67ce4a4946a6eeyJ0YWxrX3N0YXRlIjowfQ\075\075|1497742995|a2d97bc48c9411e7afd09fd554646e1f63c30c54 eyJ0YWxrX3N0YXRlIjowfQ\075\075|1497743233|b01171747934f116c7a3af5c1a3bde989f69e03dWhen I logged in from 2 different account it changed to following:First account -eyJ1c2VyX2lkIjoiMTE1Mjg2ODM5OTMyMzI1ODA5OTg4IiwidXNlcl9uYW1lIjoiU2FtIiwidGFsa19zdGF0ZSI6MH0\075|1497741945|7a7904970733851fc11eaa5ee456c4ee939f510fSecond account - eyJ1c2VyX2lkIjoiMTA3NjYzODAwMzg1MDkxODU5MzAwIiwidXNlcl9uYW1lIjoiQ3JhenlSdWciLCJ0YWxrX3N0YXRlIjowfQ\075\075|1497742305|2666b0847f1042c1d40769a19ae11741b82551bbI can't make out anything out of it except the fact that |1497742305| seem to be sort of timestamp. I have tried md5, base64 but neither of the string has any of them.What encryption is used ? How can I extract information from it ?Can someone help me out , I am new to all this.
Understanding hashing in cookies
websites;hash functions
The two vertical bars hints towards 3 separate parts of the cookie. It seems that the first part is a base64 encoded json object. For the first part of the cookie no. 1 that would be:eyJ0YWxrX3N0YXRlIjowfQ\075\075which decoded is:{talk_state:0}nb: each \075 is the unicode value for ascii character K.Post login, the first part becomes:{user_id:115286839932325809988,user_name:Sam,talk_state:0} for the base64 stringeyJ1c2VyX2lkIjoiMTA3NjYzODAwMzg1MDkxODU5MzAwIiwidXNlcl9uYW1lIjoiQ3JhenlSdWciLCJ0YWxrX3N0YXRlIjowfQ\075\075The second part as you suspected, is a timestamp in epoch date format, where 1497742098 is Mon, 19 Jun 2017 06:16:57 GMTThe last part, I am not too sure. This could be SHA1 value of some data used as an integrity check server side. You may need to play around with creating different SHA1 values using different combination of data known so far to get a matching value. 