Goal

Recover the missing last character of a decoded 31-character MD5 cookie by brute-forcing all possible characters.

Workflow

1. Decode the cookie to obtain the raw value.
2. Identify the missing character (MD5 hashes are always 32 hexadecimal characters).
3. Brute-force the last character using Burp Intruder and a wordlist (e.g., alphanum-case.txt).
4. Append each candidate character to the 31-character hash using Payload Processing.
5. Re-encode the completed 32-character value using the application's original encoding sequence.
6. Send each encoded payload until the correct cookie is found.

Key Concepts

• MD5 hashes are always 32 hexadecimal characters.
• A 31-character hash indicates one character is missing.
• Burp Intruder's Payload Processing can automatically append each candidate character.
• Always re-encode the completed hash using the same encoding methods as the application.

Encoding Rule

When recreating the cookie, apply the encoding steps in the reverse order of decoding.

Example