How the Patator HTTP_fuzz Module Handles Cookies, Redirects, and Session Management

The Patator http_fuzz module maintains session state across brute-force attempts by reusing a single pycurl handle configured with an in-memory cookie jar, automatic redirect following, and persistent TCP connections.

When performing high-speed brute-force attacks against web applications, maintaining session continuity is critical for bypassing CSRF protections and handling authentication workflows. The HTTP_fuzz class, defined in src/patator/patator.py as a subclass of TCP_Cache, implements sophisticated session management by leveraging libcurl's stateful handle architecture rather than treating each request as stateless.

Automatic Cookie Storage with accept_cookie

Enabling cookie handling requires setting the accept_cookie=1 parameter when launching a brute-force scan. According to the source code at lines 3324-3328, this option configures the pycurl handle (fp) with pycurl.COOKIEFILE = '', which initializes an in-memory cookie jar. This empty string value instructs libcurl to store cookies in memory rather than on disk, automatically attaching captured Set-Cookie headers to subsequent requests made with the same handle.

Important: The module explicitly warns against manually injecting a Cookie: header via the HTTPHEADER option when accept_cookie is enabled. Lines 3326-3329 indicate that pycurl automatically manages the Cookie header when COOKIEFILE is active, and manual injection can cause conflicts or undefined behavior.

Configurable Redirect Following

The module handles HTTP 3xx redirects through two command-line parameters: follow and max_follow. When follow=1 is specified, the code at lines 727-734 sets pycurl.FOLLOWLOCATION to 1 and configures pycurl.MAXREDIRS using the value provided to max_follow. This allows the curl handle to transparently follow Location headers up to the specified limit without requiring manual intervention or separate request logic.

Session Persistence Across Before, Main, and After Requests

One of the most powerful features of the HTTP_fuzz module is its ability to maintain session state across multi-stage request sequences. The execute() method (lines 3330-3350) uses the same pycurl handle (fp) for:

• Before requests (before_urls): Used to fetch CSRF tokens or session cookies
• Main request: The actual brute-force attempt
• After requests (after_urls): Cleanup or verification steps

Because the cookie jar lives on the reusable handle, cookies received during the before_urls phase are automatically transmitted with the main request, and any cookies set during the main request persist for after_urls processing (lines 3372-3375). This design eliminates the need for manual cookie extraction and injection in multi-step authentication workflows.

Connection Reuse and the persistent Parameter

Session management extends beyond cookies to TCP connection handling. By default, persistent=1 maintains the curl handle across iterations of the fuzzing loop, keeping the TCP connection alive and preserving the in-memory cookie store. Setting persistent=0 forces a handle reset via self.reset() (lines 80-82), which closes the connection and clears the cookie jar. This is useful when targeting applications that throttle or block reused sockets, though it incurs the overhead of new TCP/TLS handshakes for each attempt.

Practical Command Examples

Enable cookie handling and follow up to three redirects:

http_fuzz url=http://example.com/login \
          user_pass=admin:FILE0 \
          0=passlist.txt \
          accept_cookie=1 \
          follow=1 \
          max_follow=3

Use a before request to capture a CSRF token while maintaining session cookies:

http_fuzz url=http://example.com/login \
          before_urls=http://example.com/init \
          before_egrep=TOKEN:csrf=.*?value=\"([^\"]+)\" \
          before_header='User-Agent: Patator' \
          user_pass=admin:{{TOKEN}} \
          0=passlist.txt \
          accept_cookie=1

Disable persistent connections to force fresh TCP handshakes:

http_fuzz url=http://target/app \
          user_pass=user:FILE0 \
          0=wordlist.txt \
          persistent=0

Summary

• accept_cookie=1 activates an in-memory cookie jar via pycurl.COOKIEFILE, automatically storing and replaying cookies across requests made with the same handle.
• Redirect handling is controlled by follow and max_follow parameters, which configure FOLLOWLOCATION and MAXREDIRS on the curl handle.
• Session persistence across before_urls, main requests, and after_urls occurs naturally because all phases reuse the same pycurl handle with its attached cookie store.
• persistent=1 (default) keeps connections and cookies alive between brute-force iterations, while persistent=0 resets the handle and clears session state via self.reset().
• Manual Cookie headers should not be combined with accept_cookie to avoid conflicts with libcurl's internal cookie management.

Frequently Asked Questions

How does Patator store cookies when using http_fuzz?

When accept_cookie=1 is specified, Patator configures the pycurl handle with COOKIEFILE set to an empty string at line 3324 of src/patator/patator.py. This creates an in-memory cookie jar that persists for the lifetime of the handle, automatically capturing Set-Cookie headers from responses and injecting them into subsequent requests without writing data to disk.

Can http_fuzz maintain session state across multiple requests?

Yes. The HTTP_fuzz class reuses the same pycurl handle (fp) for before requests, main brute-force attempts, and after requests as implemented in the execute() method (lines 3330-3375). Because the cookie jar is attached to the handle rather than individual requests, cookies received during initial CSRF token retrieval are automatically available during the actual login attempt.

What happens when I set persistent=0 in http_fuzz?

Setting persistent=0 triggers self.reset() on the curl handle between brute-force iterations, as defined at lines 80-82. This closes the existing TCP connection and destroys the in-memory cookie store, effectively starting each attempt with a fresh session state. Use this option when targeting applications that detect or block connection reuse during rapid authentication attempts.

Does http_fuzz follow HTTP redirects automatically?

Redirect following is optional and controlled by the follow parameter. When enabled, the module sets pycurl.FOLLOWLOCATION and pycurl.MAXREDIRS based on the max_follow value (lines 727-734). This allows the module to transparently traverse 301, 302, and other 3xx responses up to the specified limit while maintaining cookies across the redirect chain.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}