Stolen session token (possible in nextcloud)

ℹ️ Support
37

I just made this quick solution to see who is actually logged in on a web frontend and what session cookies are still “alive”

I named it nc-who (after the Unix who command):

/usr/local/bin/nc-who

#!/bin/bash
# enter your secrets here:
db_user=%DB_USER%
db_pass=%DB_PASS%
db_name=nextcloud
db_pref=oc_
#db_vertical="--auto-vertical-output"
db_vertical="--vertical"

db_strg="mysql -u $db_user -p$db_pass $db_vertical --disable-auto-rehash --default-character-set=utf8mb4 $db_name -e"
db_query="SELECT FROM_UNIXTIME(last_activity) AS last_activity, FROM_UNIXTIME(last_check) AS last_check, uid, name AS client FROM ${db_pref}authtoken WHERE type = '0' AND remember = '1' ORDER BY last_activity DESC, last_check DESC"

watch -tn 1 "$db_strg \"$db_query\""

create this file in your path (I recommend /usr/local/bin/nc-who)
Make it executable:

sudo chmod +x /usr/local/bin/nc-who

And now you can watch in a terminal, who is actually loged in. It refreshes once per second, it sorts by recent activity, newest (last activities) first.

This should be just a first step, the “monitoring” part.

2 Likes