Is it possible to view session data from a website?

I have firec开发者_StackOverflow中文版ookie a plugin for firefox and when I view session values it looks like a hash of some kind. So its value is encrypted. But how can I view the actual data? Is it possible?

---

What you see is just a session id. Session stays on server you can't see it's value in client app.

---

As @Vooza said, the PHPSESSID value is just the unique ID of the session. The data is stored on the server in a secure manner.

There's no encryption or hashing taking place with the session data to produce the ID, they're in no way related, which prevents someone from accessing the data purely from the session id. An attacker could access it via session hijacking, but I'm not going to go into that.

If you just want to debug the session values, you could call: var_dump($_SESSION); to output all the session's values. I would be very careful on what information you're storing in the session while you're debugging it. $_SESSION reacts just like any other array, so you can output the values like you would with any other array.

---

It depends on how the data is hashed or encrypted, and if the data actually is in the cookie or not.

If the cookie is only a reference to data that is stored on the server, then you may not see them.

If the data is inside the cookie, but encrypted then it may be possible to decrypt them but it would probably be difficult. That's the point of decryption :-)

If the data is inside the cookie, but scrambled, then it may be possible to view them. Some cookies are Base 64 decoded. You may decode them by pasting them into an online base64 decoder. Just search for base64 and decode, and you will find one. ASP uses a cookie called viewstate. You may inspect that one by using i.e. Fiddler (http://www.fiddler2.com). There are lots of other schemes as well.