Intercepting vB login

[t0ny]

So if I match the bbsessionhash cookie with an entry in the db session table then it looks like the user is logged on?

[merk]

You will still need to check the other bbcookies for password to make sure they didnt fake a sessionhash.

[t0ny]

How is the sessionhash generated, using their password / salt and some md5 ??

Do i need to check the last activity or anything? How do i know when this cookie session has expired?

Thanks for you help, most people seem to ignore questions like this for the easier configuring ones!

[merk]

your topic isnt easy in the slightest, most people wont bother because it is so complex people shouldnt even be bothering.

it would be easier to learn php and re-write your site than change asp code to handle it (and make it work properly)

as for your questions, im really not sure. (look around line 2647 of includes/class_core.php inside the vb_Session class - it should give you enough of a hint as to how its generated)

[t0ny]

Unfortunately the application is too big to contemplate recoding, at least at this time.

I have seen these questions asked a lot over this forum though; so would be nice to see some sort of example of the best way to try to acheive it.

I have replaced two ASP parts of the system with PHP ones, the only conundrum left for me is the part where people leave comments which works two ways dependant on the login, which is all ASP..

Thanks for your help though, really appriciate it.