Curl Cookie Jar Capture and Replay via /tmp/lhr_c

Duo Tech@duotech

•updated Aug 9, 2026•2•0•7

Detects curl reusing a captured cookie jar (-b /tmp/lhr_c) against a known tunnel domain, indicating session-cookie replay to hijack an authenticated session exposed via a reverse tunnel.