Created:
12th August, 2008
Last Modified:
11th September, 2008

Stealing the X server cookie

The following script steals the X server magic cookie from one user’s cookie jar (.Xauthority), clones it and adds it to the current user’s jar, allowing them to display windows on the server as if it was their own. Quite useful if you just want to do a little bit of bug validation or testing of an unstable application while in a stable environment—just open up a terminal, su into your development user, run the thief and you’re good to go.

According to a few people “xhost +local:0” does the same thing that the script below does, however it doesn’t always work—well at least for me it doesn’t.

Expand
Download
X server cookie thief <Bash: xsteal> 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
#!/bin/bash
# X server cookie thief
# http://www.undefinedfire.com

if [ -z "$1" ]; then
    echo Usage: xsteal USER [DISPLAY]
else
    DSPLAY=":0"
    if [ -n "$2" ]; then
        DSPLAY=$2
    fi
    MAGIC=$(su --command="xauth list $DSPLAY" $1 | awk 'i < 1 { print; i++ }')
    if ( xauth add $MAGIC ); then
        echo Changed magic cookie to $MAGIC
    else
        echo Failed to change magic cookie.
    fi
fi

Comments

12th August, 2008Flyser

what about: xhost +local:0 and you have a typo in DISPLAY

12th August, 2008Lucas Murray

I guess that works too. Looks like Google has failed me once again. =(

As for DSPLAY, it was intentional.

Have your say

Markup

Because some people like to be stupid HTML is not allowed in comments, instead feel free to use the following:

  • __Bold__
  • ___Italic___
  • [Hyperlink](http://address.com)
  • [[quote source]]…[[/quote]]
  • [[code:language]]…[[/code]]

Unordered and ordered lists have each line prefixed by either a dash, asterisk, hash or a number. Your choice.

All comments are heavily moderated, if you are off-topic your comment will not be published (But I might reply by E-mail).

Be careful! Once posted you cannot edit your comment.