sessionid contains xtoken and userid

[TheCommCraft]

Maybe we could make it extract both from the session id and avoid a few extra requests

[faretek1]

in what way is the xtoken and userid stored within the sessionid? It doesn't seem to be simply be a substring

[TheCommCraft]

The part of the session id before the first colon is base64 encoded binary data, which is in turn zlib compressed json data. faretek ***@***.***> schrieb am Mo., 5. Mai 2025, 15:46:

…

*FAReTek1* left a comment (TimMcCool/scratchattach#395) <#395 (comment)> in what way is the xtoken and userid stored within the sessionid? It doesn't seem to be simply be a substring — Reply to this email directly, view it on GitHub <#395 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATCKMZQ4DU5VHJBNB6AR4ET245TURAVCNFSM6AAAAAB4NCQE7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQNJRGA3DQMJSHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[faretek1]

import base64
import zlib

session_id = '".<a big bunch of gibberish>:<a little bit of gibberish>:<a medium bit of gibberish>"'

p1, p2, p3 = session_id.split(':')
print(p1)

decoded = base64.b64decode(p1)
print(zlib.decompress(decoded))

this isn't quite working for me and I'm not really sure what's going on
even if I removed the "s at the start and end, it gives an error:

Traceback (most recent call last):
  File "...\scratchattach-13-04-2025-num2\local_test\gist\xtokentest.py", line 25, in <module>
    print(zlib.decompress(decoded))
zlib.error: Error -3 while decompressing data: invalid code -- missing end-of-block

[TheCommCraft]

i believe you need to pass p1 into zlib directly faretek ***@***.***> schrieb am So., 18. Mai 2025, 13:09:

…

*FAReTek1* left a comment (TimMcCool/scratchattach#395) <#395 (comment)> import base64import zlib session_id = '".<a big bunch of gibberish>:<a little bit of gibberish>:<a medium bit of gibberish>"' p1, p2, p3 = session_id.split(':')print(p1) decoded = base64.b64decode(p1)print(zlib.decompress(decoded)) this isn't quite working for me and I'm not really sure what's going on even if I removed the "s at the start and end, it gives an error: Traceback (most recent call last): File "...\scratchattach-13-04-2025-num2\local_test\gist\xtokentest.py", line 25, in <module> print(zlib.decompress(decoded)) zlib.error: Error -3 while decompressing data: invalid code -- missing end-of-block — Reply to this email directly, view it on GitHub <#395 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATCKMZQUS6I4UFQPFAIOXC327BS5DAVCNFSM6AAAAAB4NCQE7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQOBYHEZDMMBVGE> . You are receiving this because you were assigned.Message ID: ***@***.***>

[faretek1]

print(zlib.decompress(p1)) doesn't work because it requires a bytes object, and print(zlib.decompress(p1.encode())) doesn't work because of zlib.error: Error -3 while decompressing data: incorrect header check

[TheCommCraft]

Then you need to append "==", use urlsafe_b64decode and then put the result into zlib faretek ***@***.***> schrieb am Do., 29. Mai 2025, 16:12:

…

*FAReTek1* left a comment (TimMcCool/scratchattach#395) <#395 (comment)> print(zlib.decompress(p1)) doesn't work because it requires a bytes object, and print(zlib.decompress(p1.encode())) doesn't work because of zlib.error: Error -3 while decompressing data: incorrect header check — Reply to this email directly, view it on GitHub <#395 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATCKMZTZG65T45UZUL2RIND3A4IVHAVCNFSM6AAAAAB4NCQE7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMJZGUZTOOBRHA> . You are receiving this because you were assigned.Message ID: ***@***.***>

[faretek1]

yeah that works

[TheCommCraft]

Might prove useful faretek ***@***.***> schrieb am Do., 29. Mai 2025, 17:43:

…

*FAReTek1* left a comment (TimMcCool/scratchattach#395) <#395 (comment)> yeah that works — Reply to this email directly, view it on GitHub <#395 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATCKMZXOKIZMTETUCR5WZZ33A4TKPAVCNFSM6AAAAAB4NCQE7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMJZHAYDGMJZGQ> . You are receiving this because you were assigned.Message ID: ***@***.***>

[faretek1]

print(zlib.decompress(base64.urlsafe_b64decode(p1 + "=="))) (https://gist.github.com/FAReTek1/4834beace3876cd60912094c3c637f3a)

what are the other parts for? Also how do you know this? I can't seem to find anything useful on google

perhaps there might just be a hash for security/validation, or something?
but there is a '_auth_user_hash' within the JSON object?

[faretek1]

as for the xtoken itself, it appears to be made of 2 components too. the first part seems to be hex encoded?? It may be a hash

[TheCommCraft]

the second part is a b62 encoded timestamp and the third part is a synchronous signature for the first two parts i think faretek ***@***.***> schrieb am Do., 29. Mai 2025, 18:11:

…

*FAReTek1* left a comment (TimMcCool/scratchattach#395) <#395 (comment)> as for the xtoken itself, it appears to be made of 2 components too. the first part seems to be hex encoded?? It may be a hash — Reply to this email directly, view it on GitHub <#395 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATCKMZSCQKZELY57JJX3OR33A4WTTAVCNFSM6AAAAAB4NCQE7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMJZHA4TGMRTHA> . You are receiving this because you were assigned.Message ID: ***@***.***>

[faretek1]

ok i updated the gist for this accordingly

it's interesting that it is possible to view the age of the session from the session id but it also makes sense