# How the Patator HTTP_fuzz Module Handles Cookies, Redirects, and Session Management > Discover how the Patator http_fuzz module expertly manages cookies, redirects, and session state for efficient brute-forcing. Learn about its pycurl configuration for persistent sessions and automatic handling. - Repository: [lanjelot/patator](https://github.com/lanjelot/patator) - Tags: internals - Published: 2026-03-05 --- **The Patator `http_fuzz` module maintains session state across brute-force attempts by reusing a single pycurl handle configured with an in-memory cookie jar, automatic redirect following, and persistent TCP connections.** When performing high-speed brute-force attacks against web applications, maintaining session continuity is critical for bypassing CSRF protections and handling authentication workflows. The `HTTP_fuzz` class, defined in [`src/patator/patator.py`](https://github.com/lanjelot/patator/blob/main/src/patator/patator.py) as a subclass of `TCP_Cache`, implements sophisticated session management by leveraging libcurl's stateful handle architecture rather than treating each request as stateless. ## Automatic Cookie Storage with accept_cookie Enabling cookie handling requires setting the **`accept_cookie=1`** parameter when launching a brute-force scan. According to the source code at lines 3324-3328, this option configures the pycurl handle (`fp`) with `pycurl.COOKIEFILE = ''`, which initializes an in-memory cookie jar. This empty string value instructs libcurl to store cookies in memory rather than on disk, automatically attaching captured `Set-Cookie` headers to subsequent requests made with the same handle. **Important:** The module explicitly warns against manually injecting a `Cookie:` header via the `HTTPHEADER` option when `accept_cookie` is enabled. Lines 3326-3329 indicate that pycurl automatically manages the Cookie header when `COOKIEFILE` is active, and manual injection can cause conflicts or undefined behavior. ## Configurable Redirect Following The module handles HTTP 3xx redirects through two command-line parameters: **`follow`** and **`max_follow`**. When `follow=1` is specified, the code at lines 727-734 sets `pycurl.FOLLOWLOCATION` to 1 and configures `pycurl.MAXREDIRS` using the value provided to `max_follow`. This allows the curl handle to transparently follow Location headers up to the specified limit without requiring manual intervention or separate request logic. ## Session Persistence Across Before, Main, and After Requests One of the most powerful features of the `HTTP_fuzz` module is its ability to maintain session state across multi-stage request sequences. The `execute()` method (lines 3330-3350) uses the same pycurl handle (`fp`) for: - **Before requests** (`before_urls`): Used to fetch CSRF tokens or session cookies - **Main request**: The actual brute-force attempt - **After requests** (`after_urls`): Cleanup or verification steps Because the cookie jar lives on the reusable handle, cookies received during the `before_urls` phase are automatically transmitted with the main request, and any cookies set during the main request persist for `after_urls` processing (lines 3372-3375). This design eliminates the need for manual cookie extraction and injection in multi-step authentication workflows. ## Connection Reuse and the persistent Parameter Session management extends beyond cookies to TCP connection handling. By default, **`persistent=1`** maintains the curl handle across iterations of the fuzzing loop, keeping the TCP connection alive and preserving the in-memory cookie store. Setting `persistent=0` forces a handle reset via `self.reset()` (lines 80-82), which closes the connection and clears the cookie jar. This is useful when targeting applications that throttle or block reused sockets, though it incurs the overhead of new TCP/TLS handshakes for each attempt. ## Practical Command Examples Enable cookie handling and follow up to three redirects: ```bash http_fuzz url=http://example.com/login \ user_pass=admin:FILE0 \ 0=passlist.txt \ accept_cookie=1 \ follow=1 \ max_follow=3 ``` Use a before request to capture a CSRF token while maintaining session cookies: ```bash http_fuzz url=http://example.com/login \ before_urls=http://example.com/init \ before_egrep=TOKEN:csrf=.*?value=\"([^\"]+)\" \ before_header='User-Agent: Patator' \ user_pass=admin:{{TOKEN}} \ 0=passlist.txt \ accept_cookie=1 ``` Disable persistent connections to force fresh TCP handshakes: ```bash http_fuzz url=http://target/app \ user_pass=user:FILE0 \ 0=wordlist.txt \ persistent=0 ``` ## Summary - **`accept_cookie=1`** activates an in-memory cookie jar via `pycurl.COOKIEFILE`, automatically storing and replaying cookies across requests made with the same handle. - **Redirect handling** is controlled by `follow` and `max_follow` parameters, which configure `FOLLOWLOCATION` and `MAXREDIRS` on the curl handle. - **Session persistence** across `before_urls`, main requests, and `after_urls` occurs naturally because all phases reuse the same pycurl handle with its attached cookie store. - **`persistent=1`** (default) keeps connections and cookies alive between brute-force iterations, while `persistent=0` resets the handle and clears session state via `self.reset()`. - Manual `Cookie` headers should not be combined with `accept_cookie` to avoid conflicts with libcurl's internal cookie management. ## Frequently Asked Questions ### How does Patator store cookies when using http_fuzz? When `accept_cookie=1` is specified, Patator configures the pycurl handle with `COOKIEFILE` set to an empty string at line 3324 of [`src/patator/patator.py`](https://github.com/lanjelot/patator/blob/main/src/patator/patator.py). This creates an in-memory cookie jar that persists for the lifetime of the handle, automatically capturing `Set-Cookie` headers from responses and injecting them into subsequent requests without writing data to disk. ### Can http_fuzz maintain session state across multiple requests? Yes. The `HTTP_fuzz` class reuses the same pycurl handle (`fp`) for before requests, main brute-force attempts, and after requests as implemented in the `execute()` method (lines 3330-3375). Because the cookie jar is attached to the handle rather than individual requests, cookies received during initial CSRF token retrieval are automatically available during the actual login attempt. ### What happens when I set persistent=0 in http_fuzz? Setting `persistent=0` triggers `self.reset()` on the curl handle between brute-force iterations, as defined at lines 80-82. This closes the existing TCP connection and destroys the in-memory cookie store, effectively starting each attempt with a fresh session state. Use this option when targeting applications that detect or block connection reuse during rapid authentication attempts. ### Does http_fuzz follow HTTP redirects automatically? Redirect following is optional and controlled by the `follow` parameter. When enabled, the module sets `pycurl.FOLLOWLOCATION` and `pycurl.MAXREDIRS` based on the `max_follow` value (lines 727-734). This allows the module to transparently traverse 301, 302, and other 3xx responses up to the specified limit while maintaining cookies across the redirect chain.