How to Use Phishing Session Cookies for Red Teaming (and When They Work)

In red teaming, session cookies are a powerful tool — especially during phishing simulations. These cookies allow testers to simulate a logged-in session without needing to re-enter credentials, helping identify session handling flaws and authentication weaknesses.

This guide will explain:

• What phishing session cookies are

• How to import them into your browser using a cookie editor

• When cookies will and won’t work

Let’s break it down clearly.

When a phishing page (built using SpamTools kits) successfully captures a target’s session, it often extracts login tokens in the form of cookies. These cookies may include:

• Session identifiers

• Access tokens

• Platform-specific cookies like auth, SID, csrftoken, etc.

Once captured, these cookies can be exported and imported into a browser — giving access to the active session without needing the password, if the session is still valid.

We recommend the Chrome/Firefox extension called “Cookie-Editor.”
You can find it on the Chrome Web Store by searching "Cookie-Editor" or visit:
https://chrome.google.com/webstore/detail/cookie-editor/

Before importing cookies, open the exact domain or subdomain where the cookies were captured — for example, if the cookies are from https://example.com, you must visit that URL first.

• Click on the Cookie Editor extension icon

• Go to the Import tab

• Paste the cookie JSON exported from SpamTools

• Click Import

• Refresh the browser tab

If the cookies are valid and the session is active, you’ll be logged into the victim’s session (for testing purposes only in authorized red team simulations).

Cookies will work if:

• The target session is still active and not expired

• You open the same domain from which the cookies were captured

• The cookies aren’t marked as HttpOnly or restricted by the browser

• The target application doesn’t enforce IP locking or device fingerprint checks

• You haven’t tampered with or accidentally reformatted the cookie JSON

Cookies will fail if:

• The session has expired or the user logged out

• The domain doesn’t match exactly — even a www. vs. no www can break it

• The server has protections like IP locking, browser fingerprinting, or 2FA

• The cookie values are corrupted, truncated, or malformed

• The website sets cookies with HttpOnly, which can’t be imported manually

Some sites like Google, Microsoft, Facebook, and banking platforms use strong anti-session-hijacking defenses. Even with correct cookies, they may force a logout or trigger re-authentication.

• Always test cookies as soon as they’re captured — sessions expire fast




• Use Incognito or a fresh browser profile to avoid conflicts with existing cookies

• Avoid editing cookies manually unless you know what you're doing

• Check if the target site uses JavaScript token verification or client-side auth refresh

Still having trouble with imported cookies not working?

Reach out to our red team support at [email protected] or open a ticket in your dashboard. We're here to help you simulate safely and effectively.